CVE-2026-78654 cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution
Remote attackers can exploit prototype pollution in the deepExtend function to execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-78654?
CVE-2026-78654 is a medium-severity code injection vulnerability in cleverbrush deep, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.1 will fix this issue. The identifier of the patch is 810398c1308c500c3b8b6af380b5a89371389327. You should upgrade the affected component.
Which versions are affected by CVE-2026-78654?
How do I fix CVE-2026-78654?
No fix has been published for CVE-2026-78654 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-78654 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-78654 exists.
Sources
Also known as GHSA-85f3-5c6p-wf9v.