CVE-2026-78178CWE-1321CWE-94code-injection

CVE-2026-78178

High · published August 24, 2026

CVSS v3.1
7.3
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The reported GitHub issue was closed with the label "not planned".

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00585 · 47.2th percentile
Weaknesses
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-24T07:16Z
References (6)
https://github.com/jqwidgets/jQWidgets/ · [email protected]https://github.com/jqwidgets/jQWidgets/issues/764 · [email protected]https://vuldb.com/cve/CVE-2026-78178 · [email protected]https://vuldb.com/submit/884182 · [email protected]https://vuldb.com/vuln/394562 · [email protected]https://vuldb.com/vuln/394562/cti · [email protected]
EPSS history
Timeline
  • 24 AUG 02:45Z
    jQWidgets jqx-all.js jqxBaseFramework.extend prototype pollution
    cvelistv5