The EPSS score of 0.00306 assigned to CVE-2026-73647 is a measurement failure that will leave vulnerable Quasar deployments exposed while automated prioritization systems greenlight them as low-priority. The CVSS 5.6 rating reflects the absence of a direct RCE path from the library code alone — but this framing systematically misunderstands prototype pollution as a vulnerability class.
The extend() function in Quasar provides an attacker with a deterministic mechanism to write arbitrary properties to Object.prototype within any application that passes user-adjacent data through it. The CVE description's qualification of 'partially user-controlled objects' is the critical detail: an attacker doesn't need full control of the source object, only influence over any property that triggers a recursive descent into a polluted prototype chain. Query parameters, JWT claims, cached values, session data, and third-party API responses all qualify as user-adjacent — data that developers often sanitize against SQL injection or XSS without considering prototype chain traversal.
This isn't an isolated library vulnerability. Quasar is a framework that teaches developers how to solve problems. The extend() utility doesn't just get used internally — it becomes the mental model for how thousands of developers approach object merging in their own applications. When the 2.22.0 patch arrives, it will fix Quasar's code, but it won't reach the derivative patterns already copied into enterprise forks, tutorials, and organizational codebases. This compounding blast radius is invisible to EPSS.
Verify whether your deployment runs Quasar below 2.22.0 and audit any code paths that pass JSON from untrusted sources through framework utilities. The critical question is whether your organization's threat model treats prototype pollution as a first-class vulnerability class — or whether you're relying on CVSS/EPSS to make that determination for you. If your security workflow requires understanding prototype pollution to prioritize this patch, but your tooling surfaces it as low-priority, you have a process gap that better CVSS calculations won't solve.