CVE-2026-78179
A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled modification of object prototype attributes. The attack can be launched remotely.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
- EPSS probability
- 0.33%
- CWE
- CWE-1321, CWE-94
- Published
- 2026-08-24
- Last modified
- 2026-08-24
Affected products
- rexrainbow phaser3-rex-notes
- rexrainbow phaser3-rex-notes
- rexrainbow phaser3-rex-notes
- rexrainbow phaser3-rex-notes
- rexrainbow phaser3-rex-notes
- rexrainbow phaser3-rex-notes
- rexrainbow phaser3-rex-notes
- rexrainbow phaser3-rex-notes
Weakness type
Related vulnerabilities
- CVE-2026-89011 — isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo
- CVE-2026-86078 — n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
- CVE-2026-81994 — Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
- CVE-2026-85625 — sift 17.1.3 Prototype Pollution Remote Code Execution via $where
- CVE-2026-63376 — toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
- CVE-2026-85063 — node-csv: Prototype replacement still reachable via columns path
- CVE-2026-82404 — TOON: Prototype pollution when decoding untrusted TOON input
- CVE-2026-84368 — joi: Prototype pollution via a `__proto__` language key in custom messages