Vulnerability · Published Aug 24, 2026 · Assigned by VulDB
CVE-2026-78179rexrainbow phaser3-rex-notes BehaviorTree Blackboard Data SetValue.js SetValue prototype pollution
Medium 6.3
In plain English
A medium-severity prototype pollution in phaser3-rex-notes from rexrainbow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Official description
A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled modification of object prototype attributes. The attack can be launched remotely.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rexrainbow | phaser3-rex-notes | 1.80.01.80.11.80.21.80.31.80.41.80.51.80.61.80.7 |
Weakness: CWE-1321, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R
References
- VDB-394563 | rexrainbow phaser3-rex-notes BehaviorTree Blackboard Data SetValue.js SetValue prototype pollution vdb-entry, technical-description
- VDB-394563 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-78179 | CVE Analysis and Report third-party-advisory
- Submit #884183 | Node.js phaser3-rex-plugins 1.80.17 Prototype Pollution third-party-advisory
- https://github.com/rexrainbow/phaser3-rex-notes/issues/572 issue-tracking
- https://github.com/rexrainbow/phaser3-rex-notes/ product