Description

A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled modification of object prototype attributes. The attack can be launched remotely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-24T04:16:57.890Z",
  "pubdate": "2026-08-24T04:16:57.890Z",
  "executiveSummary": "A vulnerability classified as improperly controlled modification of object prototype attributes has been identified in rexrainbow phaser3-rex-notes up to version 1.80.17.\nThe vulnerability resides within the SetValue function of the file plugins/utils/object/SetValue.js, specifically affecting the BehaviorTree Blackboard Data Interface component.\nAn unauthenticated remote attacker can exploit this flaw by manipulating the key argument passed to the vulnerable function, leading to potential object prototype pollution.\nSuccessful exploitation of this vulnerability can result in severe integrity impacts, potentially allowing attackers to modify the behavior of global JavaScript objects across the runtime environment.\nThe risk implications include unauthorized state modification, denial of service, or potential remote code execution depending on how polluted properties are subsequently consumed by the application.\nMitigation requires updating the affected component to a patched version or applying input sanitization to ensure property keys cannot target prototype properties such as __proto__, constructor, or prototype.",
  "technicalDetails": "The vulnerability stems from unsafe recursive object property assignment in the SetValue function located at plugins/utils/object/SetValue.js within the BehaviorTree Blackboard Data Interface of phaser3-rex-notes up to version 1.80.17.\nThe root cause is the lack of proper input validation and sanitization on the key parameter when dynamically setting nested properties on JavaScript objects.\nWhen an application utilizes this function to assign values based on user-supplied or untrusted input, specially crafted keys containing strings like '__proto__', 'constructor', or 'prototype' are processed without restriction.\nThe attack flow proceeds as follows: First, an attacker identifies an entry point where remote input is passed into the SetValue function's key argument. Second, the attacker crafts a payload utilizing object traversal properties. Third, the function recursively resolves the object path, inadvertently traversing into the prototype chain of the base Object via the unsanitized key. Fourth, properties are assigned directly to Object.prototype, thereby polluting all objects instantiated within the JavaScript runtime environment.\nThis vulnerability is remotely exploitable over network exposure without requiring authentication or elevated privileges, provided the application exposes the vulnerable Blackboard Data Interface functionality to untrusted input sources.\nPost-exploitation impact includes application destabilization, logic bypasses, denial of service via property collision, or secondary security implications if sensitive properties on Object.prototype are overwritten and subsequently evaluated by security-sensitive application logic."
}