Log in Start free

Vulnerability · Published Apr 20, 2026 · Assigned by VulDB

CVE-2026-6594brikcss merge prototype pollution

High 7.3

In plain English

A high-severity prototype pollution in merge from brikcss. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 72.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing a manipulation of the argument __proto__/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@brikcss/mergeno fix listedGHSA-3jc6-6r48-v6qf

Affected products (as reported)

VendorProductVersions
brikcss merge 1.01.11.21.3.0

Weakness: CWE-1321, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

References