Description
A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled modification of object prototype attributes. The attack can be launched remotely.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rexrainbow | phaser3-rex-notes | 1.80.0, 1.80.1, 1.80.2, 1.80.3, 1.80.4, 1.80.5, 1.80.6, 1.80.7, 1.80.8, 1.80.9, 1.80.10, 1.80.11, 1.80.12, 1.80.13, 1.80.14, 1.80.15, 1.80.16, 1.80.17 | — |
References
- VDB-394563 | rexrainbow phaser3-rex-notes BehaviorTree Blackboard Data SetValue.js SetValue prototype pollution vdb-entry technical-description
- VDB-394563 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-78179 | CVE Analysis and Report third-party-advisory
- Submit #884183 | Node.js phaser3-rex-plugins 1.80.17 Prototype Pollution third-party-advisory
- https://github.com/rexrainbow/phaser3-rex-notes/issues/572 issue-tracking
- https://github.com/rexrainbow/phaser3-rex-notes/ product