CVE-2026-78178 jQWidgets jqx-all.js jqxBaseFramework.extend prototype pollution
Remote attackers can exploit prototype pollution in jQWidgets to achieve code execution, though the vendor has marked the issue as not planned for fixing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-78178?
CVE-2026-78178 is a medium-severity code injection vulnerability in jQWidgets, published on 24 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The reported GitHub issue was closed with the label "not planned".
Which versions are affected by CVE-2026-78178?
How do I fix CVE-2026-78178?
No fix has been published for CVE-2026-78178 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-78178 being exploited?
There is no known exploitation of CVE-2026-78178 in the wild and no public exploit code.
Sources
Also known as GHSA-hhpq-pm9g-crh9.