CVE-2026-78654
Received Received - Intake

Prototype Pollution in CleverBrush Framework

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulDB

Description
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.1 will fix this issue. The identifier of the patch is 810398c1308c500c3b8b6af380b5a89371389327. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-78654
EUVD
EUVD-2026-65304

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cleverbrush framework to 4.4.0 (inc)
cleverbrush deep to 4.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a prototype pollution flaw in the cleverbrush framework's deepExtend function up to version 4.4.0. It allows attackers to manipulate object prototypes by injecting special keys like __proto__ during recursive merging. This can alter the behavior of all objects in the application.

Detection Guidance

Detecting prototype pollution vulnerabilities like CVE-2026-78654 requires checking for improper handling of special keys like __proto__, constructor, or prototype in the deepExtend function. Review application code for recursive merge operations that do not exclude these keys. Use static analysis tools to scan for prototype pollution patterns in JavaScript/TypeScript codebases.

Impact Analysis

An attacker could exploit this to cause denial of service, bypass application logic, or execute secondary attacks like code execution. The impact depends on how the vulnerable function is used in your application.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, potentially violating GDPR's integrity and confidentiality requirements or HIPAA's security rules for protected health information. Compliance may be compromised if the flaw enables data breaches.

Mitigation Strategies

Immediately upgrade the affected component to version 4.4.1 or later. This version includes the patch identified by commit 810398c1308c500c3b8b6af380b5a89371389327 which fixes the prototype pollution issue in deepExtend. Review all dependencies to ensure no other components use vulnerable versions of the library.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78654. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart