CVE-2026-78179 Overview
CVE-2026-78179 is a prototype pollution vulnerability in the rexrainbow phaser3-rex-notes library through version 1.80.17. The flaw resides in the SetValue function within plugins/utils/object/SetValue.js, part of the BehaviorTree Blackboard Data Interface component. Attackers can manipulate the key argument to trigger improperly controlled modification of object prototype attributes, classified as [CWE-94] Improper Control of Generation of Code. Exploitation occurs remotely without user interaction and requires only low privileges.
Critical Impact
Remote attackers with low privileges can pollute JavaScript object prototypes through the SetValue function, potentially altering application logic across all objects sharing the prototype chain.
Affected Products
- rexrainbow phaser3-rex-notes versions up to and including 1.80.17
- BehaviorTree Blackboard Data Interface component
- Applications embedding the vulnerable SetValue.js utility
Discovery Timeline
- 2026-08-24 - CVE-2026-78179 published to NVD
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2026-78179
Vulnerability Analysis
The phaser3-rex-notes library provides plugins and utilities for the Phaser 3 game framework. Its SetValue helper in plugins/utils/object/SetValue.js assigns values to nested object properties based on a caller-supplied key string. When the key traverses reserved property names such as __proto__, constructor, or prototype, the assignment writes into the shared object prototype rather than the intended target.
Attackers who influence the key argument can inject arbitrary attributes into Object.prototype. Every downstream object then inherits the polluted properties. This can subvert authentication checks, alter configuration flags, or introduce gadgets that lead to code execution depending on how the host application consumes objects at runtime.
The BehaviorTree Blackboard is designed to store shared state accessible to multiple AI behavior nodes, which makes it an attractive sink for untrusted input. Where the blackboard exposes key/value writes to remote clients or user-controlled data, the vulnerability becomes reachable over the network.
Root Cause
The root cause is missing sanitization of the property path passed to SetValue. The function walks the key string and assigns intermediate properties without denylisting prototype-related identifiers, matching the pattern described in [CWE-94].
Attack Vector
Exploitation is network-based and requires low privileges without user interaction. An attacker submits a crafted key containing prototype-traversal segments through any interface that reaches SetValue, such as game state synchronization messages, behavior tree configuration inputs, or JSON payloads deserialized into the blackboard.
The vulnerability mechanism is documented in the upstream tracker. See the GitHub Issue #572 and the VulDB CVE-2026-78179 entry for technical details.
Detection Methods for CVE-2026-78179
Indicators of Compromise
- Inbound requests containing __proto__, constructor.prototype, or prototype tokens within key or path parameters directed at Phaser-based applications.
- Unexpected properties appearing on Object.prototype at runtime, observable through instrumentation or unit tests that enumerate base object keys.
- Anomalous behavior in BehaviorTree Blackboard state, such as global flags flipping without a legitimate write source.
Detection Strategies
- Perform static analysis on application code paths that invoke SetValue from plugins/utils/object/SetValue.js and flag any that accept externally controlled key strings.
- Add runtime guards that reject key paths containing reserved prototype identifiers and log rejected attempts for review.
- Inspect application logs and HTTP traffic for JSON bodies where object keys include prototype pollution markers.
Monitoring Recommendations
- Alert on WAF or reverse proxy events that match prototype pollution signatures across game backends and Node.js services embedding Phaser assets.
- Track dependency inventories to identify deployments still pinned to phaser3-rex-notes at or below 1.80.17.
- Correlate client-supplied blackboard writes with subsequent privilege or configuration changes to surface exploitation attempts.
How to Mitigate CVE-2026-78179
Immediate Actions Required
- Upgrade phaser3-rex-notes beyond version 1.80.17 once the maintainer publishes a fixed release. Track progress via the upstream repository.
- Audit all call sites of SetValue and reject any invocation where the key originates from untrusted input.
- Constrain BehaviorTree Blackboard writes to a server-side allowlist of expected property paths.
Patch Information
No fixed version was identified in the NVD data at publication. Monitor the GitHub repository and GitHub Issue #572 for a maintainer response. In the interim, apply the workarounds below.
Workarounds
- Wrap SetValue with a validator that rejects keys containing __proto__, constructor, or prototype segments before delegating to the vulnerable function.
- Freeze Object.prototype at application startup using Object.freeze(Object.prototype) to prevent runtime mutations, after verifying compatibility with dependent code.
- Store blackboard data in objects created with Object.create(null) so writes cannot traverse into a shared prototype.
- Deploy input validation at the network boundary to strip prototype-related tokens from client-supplied JSON payloads.
# Configuration example: enumerate installed versions to identify vulnerable deployments
npm ls phaser3-rex-notes
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
