CVE-2026-78178
A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The reported GitHub issue was closed with the label "not planned".
Scoring
- Severity
- MEDIUM
- CVSS base score
- 7.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
- EPSS probability
- 0.44%
- CWE
- CWE-1321, CWE-94
- Published
- 2026-08-24
- Last modified
- 2026-08-27
Affected products
- n/a jQWidgets
- n/a jQWidgets
Weakness type
Related vulnerabilities
- CVE-2026-86078 — n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
- CVE-2026-81994 — Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
- CVE-2026-85625 — sift 17.1.3 Prototype Pollution Remote Code Execution via $where
- CVE-2026-63376 — toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
- CVE-2026-85063 — node-csv: Prototype replacement still reachable via columns path
- CVE-2026-82404 — TOON: Prototype pollution when decoding untrusted TOON input
- CVE-2026-84368 — joi: Prototype pollution via a `__proto__` language key in custom messages
- CVE-2026-84367 — joi: object().rename() with a template target can set the validated object's prototype