CVE-2026-78179
Received Received - Intake

Improper Prototype Pollution in rexrainbow phaser3-rex-notes

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulDB

Description
A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled modification of object prototype attributes. The attack can be launched remotely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78179
EUVD
EUVD-2026-64701

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rexrainbow phaser3-rex-notes to 1.80.17 (inc)
rexrainbow phaser3-rex-plugins to 1.80.17 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a prototype pollution vulnerability in the phaser3-rex-plugins library affecting the BehaviorTree Blackboard path setter functionality. The issue is in SetValue.js which processes dotted key paths to create nested objects. It fails to validate prototype-related path segments like __proto__, constructor, or prototype, allowing attackers to manipulate Object.prototype through methods like set(), setData(), inc(), and toggle().

Detection Guidance

To detect this prototype pollution vulnerability, inspect applications using phaser3-rex-plugins version 1.80.17 or earlier. Check for usage of BehaviorTree Blackboard methods like set(), setData(), inc(), toggle(), Tree.js setValue(), or setRefPath(). Look for paths containing __proto__, constructor, or prototype in SetValue.js. Use static analysis tools to scan JavaScript files for unsafe object manipulation patterns.

Impact Analysis

An attacker could exploit this to add unintended properties to all objects, causing logic corruption, denial of service, or unexpected behavior in applications using these APIs. This could lead to crashes, data leaks, or application misbehavior.

Compliance Impact

This vulnerability allows remote attackers to manipulate Object.prototype through prototype pollution, which could lead to unintended property additions on all objects. This may cause logic corruption, denial of service, or unexpected behavior in applications. Such impacts could potentially violate data integrity and availability requirements under GDPR and HIPAA, depending on the affected system's use case.

Mitigation Strategies

Immediately upgrade phaser3-rex-plugins to a patched version beyond 1.80.17. If upgrading is not possible, implement input validation to reject path segments like __proto__, constructor, or prototype in SetValue.js. Add runtime checks in BehaviorTree Blackboard and Tree.js methods to block unsafe keys. Review application logic for unintended prototype modifications and test thoroughly after changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78179. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart