CVE-2026-78179CWE-1321CWE-94code-injection

CVE-2026-78179

Medium · published August 24, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled modification of object prototype attributes. The attack can be launched remotely.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00446 · 37.8th percentile
Weaknesses
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-24T08:16Z
References (6)
https://github.com/rexrainbow/phaser3-rex-notes/ · [email protected]https://github.com/rexrainbow/phaser3-rex-notes/issues/572 · [email protected]https://vuldb.com/cve/CVE-2026-78179 · [email protected]https://vuldb.com/submit/884183 · [email protected]https://vuldb.com/vuln/394563 · [email protected]https://vuldb.com/vuln/394563/cti · [email protected]
EPSS history
Timeline
  • 24 AUG 03:00Z
    rexrainbow phaser3-rex-notes BehaviorTree Blackboard Data SetValue.js SetValue prototype pollution
    cvelistv5