The SetValue function in the BehaviorTree Blackboard Data Interface of the phaser3‑rex‑notes plugin processes a key argument used to modify object properties. An attacker can supply a specially crafted key that writes to properties on the JavaScript object prototype. Such prototype pollution enables the attacker to alter the behavior of built‑in objects, potentially causing unpredictable program flow or facilitating other attacks. The CVE description notes that manipulating the key gives uncontrolled modification of the prototype and that the attack can be launched remotely.

The flaw exists in rexrainbow’s phaser3‑rex‑notes library up to release 1.80.17. Any application that incorporates that version of the plugin—whether directly or as a dependency—is susceptible. The affected product is the BehaviorTree Blackboard component within the phaser3‑rex‑notes plugin.

The base CVSS score of 5.3 indicates moderate severity, but the EPSS score is not available, so the probability of exploitation is uncertain. The description explicitly states that the vulnerability can be triggered from a remote context. It is not listed in the CISA KEV catalog, so no active exploitation has been reported at this time. Nonetheless, prototype pollution can lead to unpredictable runtime behavior and may provide a foothold for more serious attacks if the application exposes the vulnerable function to untrusted input.