Answer in brief
CVE-2026-73647 records a Medium severity (CVSS 5.6) vulnerability in Quasar Framework: Prototype pollution in Quasar extend() utility. The current sources do not mark it as known exploited. The current feed maps quasarframework/quasar (generic), quasar (npm), quasar (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.6. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps quasarframework/quasar (generic), quasar (npm), quasar (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| quasarframework/quasargeneric | < 2.22.0 | Not reported |
| quasarnpm | <=2.21.4 | 2.22.0 |
| quasarnpm | >=0 <2.22.0 | 2.22.0 |
Published upstream
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 13, 2026
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-73647 records a Medium severity (CVSS 5.6) vulnerability in Quasar Framework: Prototype pollution in Quasar extend() utility. The current sources do not mark it as known exploited. The current feed maps quasarframework/quasar (generic), quasar (npm), quasar (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.6. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps quasarframework/quasar (generic), quasar (npm), quasar (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| quasarframework/quasargeneric | < 2.22.0 | Not reported |
| quasarnpm | <=2.21.4 | 2.22.0 |
| quasarnpm | >=0 <2.22.0 | 2.22.0 |
Published upstream
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 13, 2026
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.
Quoted source text, attributed separately from HOL analysis.