Update dependency quasar to v2 [SECURITY] by renovate[bot] · Pull Request #107 · MiniDigger/MiniMappingViewer

renovate · 2026-08-26T12:44:31Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
quasar (source)	`1.14.5` → `2.22.0`

Quasar: Prototype pollution in the extend() utility

CVE-2026-73647 / GHSA-3r53-75j5-3g7j

More information

Details

Summary

quasar@2.20.1, the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public extend() utility exported from the package root.

When extend(true, target, source) is used for a deep merge, attacker-controlled object keys are recursively copied into the target object without blocking prototype-pollution primitives such as __proto__, constructor, or prototype.

This can allow attacker-controlled properties to be written to Object.prototype.

Details

Affected source:

src/utils/extend/extend.js

Distributed files include:

dist/quasar.server.prod.js
dist/quasar.server.prod.cjs
dist/quasar.client.js

The package root publicly exports extend. During deep merge, source object keys are recursively assigned into the target object. If the source object contains an own __proto__ property, the merge can descend into the prototype object and assign attacker-controlled properties onto Object.prototype.

PoC

rm -rf /tmp/quasar-extend-pp-poc
mkdir /tmp/quasar-extend-pp-poc
cd /tmp/quasar-extend-pp-poc

npm init -y >/dev/null
npm install quasar@2.20.1 vue@3.5.31 >/dev/null

cat > hack.mjs <<'JS'
import { extend } from 'quasar';

delete Object.prototype.polluted;

extend(true, {}, {
  ['__proto__']: {
    polluted: 'yes'
  }
});

console.log(({}).polluted);

delete Object.prototype.polluted;
JS

node ./hack.mjs

Observed output:

yes

Expected output:

undefined

Impact

This is a prototype pollution vulnerability.

If an application passes user-controlled or partially user-controlled objects into extend(true, ...), an attacker may be able to pollute Object.prototype in the same JavaScript process.

Depending on how the polluted property is later consumed, this may lead to logic bypass, unsafe default option injection, denial of service, or other application-specific security impact.

Suggested Fix

Reject or safely ignore dangerous keys before assignment, including:

__proto__
prototype
constructor

The merge implementation should also avoid descending into prototype-related properties during recursive merge.

Severity

CVSS Score: 5.6 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

quasarframework/quasar (quasar)

Uh oh!

Conversation

renovate Bot commented Aug 26, 2026

Quasar: Prototype pollution in the extend() utility

Details

Summary

Details

PoC

Impact

Suggested Fix

Severity

References

Release Notes

Security fixes

Other fixes

Donations

Changes

Donations

Changes

Donations

Changes

Donations

Changes

Donations

Changes

Donations

Changes

Donations

Changes

Donations

Fixes

Donations

Changes

Donations

Changes

Donations

Changes

Donations

Changes

Donations

Changes

Donations

Changes

Donations

Changes

Donations

Changes

Donations

New

Donations

Changes

Donations

New

Changes

Donations

Fixes

Donations

New

Fixes

Donations

Changes

Donations

Fixes

Donations

Fixes

Donations

Fixes

Donations

Fixes

Donations

Fixes

Donations

New

Fixes

Donations

Potential upgrade issue

New

Fixes

Donations

Fixes