Quasar npm Package <=2.20.1 Vulnerable to Prototype Pollution
The quasar npm package version 2.20.1 is under investigation for a prototype pollution vulnerability in its extend() utility, which may allow attacker-controlled properties to be written to Object.prototype.
What happened
An early warning has been issued regarding a potential vulnerability in the quasar npm package version 2.20.1. The issue, tracked as GHSA-3R53-75J5-3G7J, involves prototype pollution in the extend() utility. This vulnerability appears to allow an attacker to write properties to Object.prototype, which could lead to unexpected behavior in applications that depend on the quasar package.
Professional software engineers using quasar in their projects should assess their exposure to this vulnerability. If your project depends on quasar version 2.20.1 or earlier, it is recommended to upgrade to a version that addresses this issue or apply a patch if one becomes available. For the latest information and to confirm the vulnerability, consult the primary source at https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j.
As this is an early warning, the full impact and details of the vulnerability are still under investigation. It is crucial to stay updated with the latest advisories and security patches to mitigate any potential risks associated with this vulnerability.
How 0Day mitigates this
quasar is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.