The brikcss merge library contains a prototype pollution flaw in versions up to 1.3.0. A malicious user can supply an argument containing __proto__/constructor.prototype entries that cause the merge operation to write values into the Object prototype. This uncontrolled modification enables the attacker to alter global object properties, which can lead to logic bypasses or execution of arbitrary code. The weakness falls under CWE‑1321 and CWE‑94, reflecting unsanitized manipulation of built‑in prototypes and potential code injection.

The vulnerability is present in the brikcss merge package for all releases through 1.3.0. No specific sub‑module is identified, so any installation of brikcss merge in that range is potentially affected.

With a CVSS score of 6.9, the flaw poses a moderate overall risk. No EPSS data is available and the issue is not listed in the CISA KEV catalog, but the vulnerability can be triggered remotely by supplying crafted input to the merge function. Attackers who gain control over the merge call are able to inject prototype properties that may compromise the application’s correctness or enable further exploitation. Because the vendor has not released a patch, the risk remains present until an updated version is applied or mitigations are enforced.