CVE-2026-78178
Received Received - Intake

Prototype Pollution in jQWidgets

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulDB

Description
A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The reported GitHub issue was closed with the label "not planned".

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78178
EUVD
EUVD-2026-64700

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jqwidgets jqwidgets to 24.0.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78178 is a prototype pollution vulnerability in jQWidgets up to version 24.0.1. It affects the functions JQXLite.extend and jqxBaseFramework.extend in the file jqwidgets/jqx-all.js. These functions perform a deep merge of objects without properly sanitizing prototype-related keys like __proto__, constructor, or prototype. Attackers can exploit this to inject malicious properties into Object.prototype, which then affects all objects in the JavaScript environment.

Detection Guidance

To detect this prototype pollution vulnerability in jQWidgets, inspect JavaScript code using vulnerable functions like JQXLite.extend or jqxBaseFramework.extend. Check if untrusted input is passed to these functions. Review network traffic for requests loading jqwidgets/jqx-all.js from versions up to 24.0.1.

Impact Analysis

This vulnerability can lead to unexpected behavior in applications using jQWidgets, such as property access changes or denial of service. If your application loads configuration or user-generated content from external sources and passes it to the vulnerable merge functions, it may be at risk. Attackers could manipulate the prototype chain to alter application behavior or corrupt inherited properties.

Compliance Impact

The vulnerability allows prototype pollution, which could lead to unauthorized data access or modification. This may impact compliance with GDPR (data protection) and HIPAA (healthcare data security) by enabling breaches of confidentiality or integrity of sensitive information.

Mitigation Strategies

Immediately upgrade jQWidgets to a patched version if available. If not, sanitize all inputs passed to JQXLite.extend or jqxBaseFramework.extend by rejecting prototype-related keys like __proto__, constructor, or prototype. Use safer alternatives like Object.keys() for iteration and avoid recursive merges into inherited objects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78178. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart