Description
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.1 will fix this issue. The identifier of the patch is 810398c1308c500c3b8b6af380b5a89371389327. You should upgrade the affected component.
Published: 2026-08-25
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is a prototype pollution flaw in the deepExtend function of the cleverbrush framework. By manipulating input, an attacker can inject properties into JavaScript prototypes, potentially overriding critical methods or enabling arbitrary code execution. The flaw is based on CWE-1321 and arises from improper control of prototype assignments.

Affected Systems

Affected products are the cleverbrush framework and the cleverbrush deep utility, specifically all releases up to version 4.4.0. Any installation using the deepExtend function from the libs/deep/src/deepExtend.ts file is impacted, while upgrades to 4.4.1 or later contain the fix.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, and the lack of a KEV listing suggests no public demonstrators yet. EPSS data is unavailable, but the description states remote exploitation is possible. The likely attack vector involves remote input that is processed by deepExtend, which infers that an attacker could trigger the prototype pollution from a web or API endpoint.

Generated by OpenCVE AI on August 25, 2026 at 07:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the cleverbrush framework to version 4.4.1 or newer and verify the presence of commit 810398c1308c500c3b8b6af380b5a89371389327
  • If an upgrade cannot be applied immediately, restrict or sanitize all data passed to deepExtend to prevent malicious prototype assignments
  • Implement runtime monitoring or logging for changes to Object.prototype to detect prototype pollution attempts

Generated by OpenCVE AI on August 25, 2026 at 07:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.1 will fix this issue. The identifier of the patch is 810398c1308c500c3b8b6af380b5a89371389327. You should upgrade the affected component.
Title cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution
First Time appeared Cleverbrush
Cleverbrush deep
Cleverbrush framework
Weaknesses CWE-1321
CWE-94
CPEs cpe:2.3:a:cleverbrush:deep:*:*:*:*:*:*:*:*
cpe:2.3:a:cleverbrush:framework:*:*:*:*:*:*:*:*
Vendors & Products Cleverbrush
Cleverbrush deep
Cleverbrush framework
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Cleverbrush Deep Framework
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-25T06:00:13.406Z

Reserved: 2026-08-24T23:08:18.011Z

Link: CVE-2026-78654

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-25T06:19:01.940

Modified: 2026-08-25T06:19:01.940

Link: CVE-2026-78654

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T07:30:12Z

Weaknesses
  • CWE-1321

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')