The extend() utility in Quasar Framework performs deep merges by recursively copying keys from a source object into a target, but it does not reject an own __proto__ property. This allows an attacker to inject keys into Object.prototype within the same JavaScript process. Polluted prototype properties can subsequently be read or executed by the application, enabling logic bypass, unsafe default-option injection, or denial of service. The vulnerability is classified as CWE‑1321.

Quasar Framework, all versions prior to 2.22.0. Applications that consume the public extend() function and pass user‑controlled or partially user‑controlled objects to it are affected.

The CVSS score is 5.6, indicating a moderate severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog. The likely attack vector is application‑level, where user input is merged into internal objects via extend(); exploitation requires that the attacker can influence the source object passed to the function. If the application merges untrusted data, prototype pollution could lead to significant logic circumvention or denial of service, depending on downstream use of Object.prototype properties.