Quasar npm Package <=2.20.1: Prototype Pollution Vulnerability
The quasar npm package version 2.20.1 is reportedly vulnerable to prototype pollution through its extend() utility. This can allow attacker-controlled properties to be written to Object.prototype.
What happened
An early warning has been issued regarding a potential prototype pollution vulnerability in the quasar npm package version 2.20.1. The vulnerability appears to be present in the extend() utility, which can allow attacker-controlled properties to be written to Object.prototype. This issue is currently under investigation by the maintainers of the quasar package. To assess your exposure, check if your project is using quasar version 2.20.1 or earlier. If so, consider upgrading to a version that includes a fix for this vulnerability, or avoid using the extend() utility with untrusted input. For the latest information, consult the primary source at https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j.
How 0Day mitigates this
quasar is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.