CVE-2026-78654
cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution
- State
- Published
- Severity
- 6.9 Medium
- Published
- Aug 25, 2026
- Updated
- Aug 25, 2026
- Reserved
- Aug 24, 2026
Description
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.1 will fix this issue. The identifier of the patch is 810398c1308c500c3b8b6af380b5a89371389327. You should upgrade the affected component.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
frameworkcleverbrush |
|
deepcleverbrush |
|
References
- VDB-394866 | cleverbrush framework/deep deepExtend.ts deepExtend prototype pollutionvdb-entrytechnical-description
- VDB-394866 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-78654 | CVE Analysis and Reportthird-party-advisory
- Submit #886401 | cleverbrush @cleverbrush/deep (npm) <=4.4.0 Prototype Pollutionthird-party-advisory
- https://github.com/cleverbrush/framework/issues/213exploitissue-tracking
- https://github.com/cleverbrush/framework/pull/215issue-trackingpatch
- https://github.com/cleverbrush/framework/commit/810398c1308c500c3b8b6af380b5a89371389327patch
- https://github.com/cleverbrush/framework/releases/tag/%40cleverbrush/async%404.4.1patch
- https://github.com/cleverbrush/framework/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.