The vulnerability exists in jQWidgets versions up to 24.0.1 and is located in the JQXLite.extend/jqxBaseFramework.extend function of jqx-all.js. By manipulating prototype attributes through this function, an attacker can perform prototype pollution, which can lead to arbitrary code execution or altered behavior of the application in the context of the client. The flaw is due to improperly controlled modification of object prototype attributes, as the function does not validate input before extending prototypes.

The affected product is jQWidgets, the JavaScript UI library. All releases through version 24.0.1 are vulnerable. No other vendors or versions are recorded as impacted.

The CVSS base score is 6.9, indicating moderate severity. The flaw can be triggered remotely by loading a crafted payload that invokes the extend routine; no authentication is required. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker could exploit prototype pollution to execute arbitrary code or redirect application logic, potentially compromising confidentiality, integrity, or availability of the affected web pages.