CVE-2026-6594
CVE-2026-6594 · brikcss merge prototype pollution
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing a manipulation of the argument __proto__/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 6.9 · Medium · EPSS 0.3%
- Published
- Updated
Stack: node
Affected products and versions
merge
- Versions
- 1.0: Affected
- 1.1: Affected
- 1.2: Affected
- 1.3.0: Affected
No fix published
@brikcss/merge npm
- Affected ranges
- SEMVER: ≤ 1.3.1
No fix published