{"action":"Upgrade quasar to 2.22.0 or later.","affected":[{"fixed":"2.22.0","introduced":"0"}],"component":"quasar","cve_ids":["CVE-2026-73647"],"ecosystem":"npm","epss":0.00387,"exploited":false,"fixed_versions":["2.22.0"],"ghsa_id":"GHSA-3r53-75j5-3g7j","id":"tcs_01M5KEY4MZC0T4P07C18X2M6DN","modified_at":"2026-08-13T18:51:16.673123Z","published_at":"2026-07-24T22:36:45Z","references":["https://osv.dev/vulnerability/GHSA-3r53-75j5-3g7j","https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j","https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7","https://github.com/quasarframework/quasar","https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0"],"severity":{"label":"medium","score":5.6},"sources":[{"source":"osv","source_id":"GHSA-3r53-75j5-3g7j","url":"https://osv.dev/vulnerability/GHSA-3r53-75j5-3g7j"}],"summary":"Quasar: Prototype pollution in the extend() utility"}