{"apiVersion":"1.0","identifier":"CVE-2026-73647","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.","publishedAt":"2026-08-13T18:18:20","lastModifiedAt":"2026-08-13T19:17:36","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73647","cvssScore":5.6,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","epssProbability":0.00306,"riskScore":0.58,"affectedProduct":"Quasar Framework","affectedVersions":"<2.22.0","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-73647","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-73647","en":"https://www.redsauce.net/en/cves/CVE-2026-73647","fr":"https://www.redsauce.net/fr/cves/CVE-2026-73647","pt":"https://www.redsauce.net/pt/cves/CVE-2026-73647","de":"https://www.redsauce.net/de/cves/CVE-2026-73647","sk":"https://www.redsauce.net/sk/cves/CVE-2026-73647","el":"https://www.redsauce.net/el/cves/CVE-2026-73647"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-73647"}}