CVE-2026-78654: Cleverbrush Framework Prototype Pollution RCE

CVE-2026-78654 Overview

CVE-2026-78654 is a prototype pollution vulnerability in the cleverbrush framework, affecting the @cleverbrush/deep package up to version 4.4.0. The flaw resides in the deepExtend function within libs/deep/src/deepExtend.ts. Attackers can manipulate object prototype attributes by supplying crafted input containing reserved keys such as __proto__, constructor, or prototype. The issue is remotely exploitable and has been publicly disclosed. Upgrading to version 4.4.1 resolves the issue via commit 810398c1308c500c3b8b6af380b5a89371389327. The vulnerability is classified under [CWE-94] (Improper Control of Generation of Code).

Critical Impact
Remote attackers can pollute JavaScript object prototypes, enabling downstream impacts such as denial of service, logic corruption, or potential code execution depending on how host applications consume merged objects.

Affected Products

@cleverbrush/deep versions up to and including 4.4.0
@cleverbrush/framework monorepo components that depend on deepExtend
Applications transitively depending on the vulnerable package

Discovery Timeline

2026-08-25 - CVE-2026-78654 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78654

Vulnerability Analysis

The deepExtend function recursively merges properties from source objects into a target object. Prior to the fix, the merge logic did not exclude reserved property keys. An attacker who controls any part of a merged object can inject keys like __proto__.polluted, which mutate Object.prototype. All objects in the running Node.js process then inherit the injected property. Consequences depend on how the host application uses object properties, ranging from application logic corruption to remote code execution in gadget-chain scenarios.

Root Cause

The root cause is missing key validation during recursive object merging. The pre-patch TypeScript types permitted __proto__, constructor, and prototype as legitimate merge keys. Because no runtime allowlist filtered these keys, assignments such as target[key] = source[key] reached prototype slots and polluted the global prototype chain.

Attack Vector

Exploitation requires an attacker to supply a JSON payload or object reaching a call site of deepExtend. This commonly occurs in Node.js services parsing user-controlled HTTP request bodies before merging them into configuration or option objects. No authentication or user interaction is required in typical deployments.

typescript

// Security patch applied in libs/deep/src/deepExtend.ts
+type UnsafeMergeKey = '__proto__' | 'constructor' | 'prototype';
+
+type SafeMergeProps<T> = Omit<T, UnsafeMergeKey>;
+
+type SafeProp<T, K extends PropertyKey> = K extends keyof SafeMergeProps<T>
+    ? SafeMergeProps<T>[K]
+    : never;
+
 /** Properties that exist in both `T1` and `T2`, typed as `T2`'s version. */
 export type CommonProps<T1, T2> = {
-    [k in keyof T1 & keyof T2]: T1[k] extends never
+    [k in keyof SafeMergeProps<T1> & keyof SafeMergeProps<T2>]: SafeProp<
+        T1,
+        k
+    > extends never
         ? never
-        : T2[k] extends never
+        : SafeProp<T2, k> extends never
           ? never
-          : T2[k];
+          : SafeProp<T2, k>;
 };
 
 /** Properties present in `T1` but not in `T2`. */
-export type PropsInFirstOnly<T1, T2> = Omit<T1, keyof T2>;
+export type PropsInFirstOnly<T1, T2> = Omit<
+    SafeMergeProps<T1>,
+    keyof SafeMergeProps<T2>
+>;

Source: GitHub Commit 810398c. The patch introduces SafeMergeProps and SafeProp types that exclude __proto__, constructor, and prototype from the merge surface.

Detection Methods for CVE-2026-78654

Indicators of Compromise

Inbound HTTP requests containing JSON payloads with keys __proto__, constructor, or prototype.
Unexpected property additions to Object.prototype at runtime in Node.js processes.
Application errors referencing properties that were never explicitly assigned by the code.

Detection Strategies

Perform a software composition analysis scan across package.json and package-lock.json files for @cleverbrush/deep at versions at or below 4.4.0.
Instrument web application firewalls (WAFs) to flag request bodies containing reserved prototype keys.
Add runtime assertions or use Object.freeze(Object.prototype) in test environments to surface pollution attempts.

Monitoring Recommendations

Log and alert on Node.js process behavior changes such as new global properties or altered function references.
Correlate application error spikes with inbound requests containing suspicious JSON keys.
Track outbound dependency updates and validate that @cleverbrush/deep resolves to 4.4.1 or later in build pipelines.

How to Mitigate CVE-2026-78654

Immediate Actions Required

Upgrade @cleverbrush/deep to version 4.4.1 or later across all projects and lockfiles.
Audit application code for direct or transitive calls to deepExtend with attacker-controlled inputs.
Deploy WAF rules that reject request bodies containing __proto__, constructor, or prototype keys.

Patch Information

The fix is delivered in the GitHub Release @cleverbrush/async v4.4.1 via commit 810398c1308c500c3b8b6af380b5a89371389327. Details are tracked in GitHub Issue #213 and merged through GitHub Pull Request #215. Additional context is available at VulDB CVE-2026-78654.

Workarounds

Sanitize inbound JSON by recursively removing keys matching __proto__, constructor, and prototype before invoking merge functions.
Use Object.create(null) for target objects passed to deepExtend to eliminate prototype linkage.
Freeze Object.prototype at process startup with Object.freeze(Object.prototype) if application compatibility allows.

bash

# Upgrade the vulnerable package to the patched release
npm install @cleverbrush/deep@^4.4.1

# Verify the resolved version in the lockfile
npm ls @cleverbrush/deep