CVE-2026-73647

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.

• CWE-1321

• https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7
• https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0
• https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j
• https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j

Published

Aug 13, 2026

Last Modified

Aug 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73635Allocation of resources without limits or throttling vulnera…7.5
• CVE-2026-7364IBM Verify Identity Access 11.0 through 11.0.2 and IBM Secur…6.1
• CVE-2026-73643js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 u…7.5
• CVE-2026-73644OpenDJ is an LDAPv3 compliant directory service. Prior to 5.…9.6
• CVE-2026-73645OpenZeppelin Confidential Contracts is an experimental libra…6.6
• CVE-2026-73646PostCSS takes a CSS file and provides an API to analyze and …7.5
• CVE-2026-73648rails-html-sanitizer is responsible for sanitizing HTML frag…5.1
• CVE-2026-73649Velocity.js is a JavaScript implementation of the Apache Vel…9.8
• CVE-2026-7365IBM Operations Analytics - Log Analysis  and IBM SmartCloud …7.8
• CVE-2026-73650SVGO, short for SVG Optimizer, is a Node.js library and comm…8.2
• CVE-2026-73651TypeORM is a TypeScript and JavaScript ORM for Node.js that …5.7
• CVE-2026-73652vantage6 is an open-source infrastructure for privacy preser…7.1