GHSA-3R53-75J5-3G7J: GHSA-3r53-75j5-3g7j: Prototype Pollution in Quasar Framework extend Utility

#security #cve #cybersecurity #ghsa

GHSA-3r53-75j5-3g7j: Prototype Pollution in Quasar Framework extend Utility

Vulnerability ID: GHSA-3R53-75J5-3G7J
CVSS Score: 5.6
Published: 2026-07-24

A prototype pollution vulnerability (CWE-1321) in the Quasar framework's utility function 'extend' allows unauthenticated remote attackers to modify the global Object.prototype. This vulnerability can lead to application-level logic bypasses, denial of service, or potentially arbitrary code execution depending on downstream implementation.

TL;DR

A recursive object merge flaw in Quasar's 'extend' utility allows attackers to pollute Object.prototype via 'proto' injection, risking arbitrary code execution or application bypasses.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-1321
Attack Vector: Network (AV:N)
CVSS Base Score: 5.6
Impact: Low Integrity, Low Confidentiality, Low Availability
Exploit Status: Proof-of-concept available
CISA KEV Status: Not Listed

Affected Systems

Web applications built using Quasar Framework npm package
Node.js server-side configurations employing Quasar extend utilities
quasar: < 2.22.0 (Fixed in: 2.22.0)

Code Analysis

Commit: d0a95d9

fix(utils): skip proto properties in extend utility to prevent prototype pollution

@@ -58,6 +58,10 @@
   for (; i < length; i++) {
     if ((options = args[i]) !== null) {
       for (name in options) {
+        if (name === '__proto__') {
+          continue
+        }
+
         src = target[name]
         copy = options[name]

Exploit Details

GitHub Security Advisory: Advisory write-up and baseline proof-of-concept showcasing the proto pollution mechanism using the framework's extend utility.

Mitigation Strategies

Upgrade Quasar Framework npm package to version 2.22.0 or higher
Implement inputs validation to filter or sanitize keys like proto, constructor, and prototype
Freeze the global Object prototype using Object.freeze(Object.prototype) in secure environments

Remediation Steps:

Locate package.json and identify the quasar dependency
Run 'npm install quasar@2.22.0' or 'yarn upgrade quasar@2.22.0'
Verify that the application's lockfile resolves to the patched version
Audit any direct or indirect usages of the 'extend' utility function in the source code

References

Read the full report for GHSA-3R53-75J5-3G7J on our website for more details including interactive diagrams and full exploit analysis.

DEV Community