cleverbrush deep CVE-2026-78654

Exploitation requires that the target application uses @cleverbrush/deep (or @cleverbrush/framework) at version 4.4.0 or earlier AND passes attacker-controlled data - such as a parsed JSON request body, query parameter, or file upload - into deepExtend() without prior sanitization of prototype-polluting keys. The CVSS PR:N metric confirms no authentication is required at the library level; however, exploitation is bounded by the application's exposure surface: if deepExtend() is only called with developer-controlled, hardcoded objects, the vulnerability is unexploitable regardless of the library version. Impact severity is further conditioned on how the host application uses plain-object properties for security or control-flow decisions - applications that do not rely on dynamic property lookups for access control are less impacted. No specific non-default configuration flag is required; the flaw exists in the default behavior of the function.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:L/VI:L/VA:L and SC:N/SI:N/SA:N, E:P) yields a score of 5.5, reflecting low-complexity network exploitation with limited per-system impact. The CVSS 4.0 subsequent-system metrics (SC:N/SI:N/SA:N) understate real-world chained risk: prototype pollution in a JavaScript runtime is a scope-changing primitive - once Object.prototype is mutated, every plain object inherits the injected properties, which can cascade into authentication bypasses, privilege escalation, or denial of service depending on how the host application consumes object properties. EPSS data was not provided in the input, so exploitation probability cannot be quantified numerically. The E:P supplemental tag and GitHub issue #213 confirm publicly available exploit code, which lowers the skill bar for exploitation. The CVE is absent from CISA KEV, so mass active exploitation is not confirmed. Real-world priority should be calibrated against whether any application endpoint exposes deepExtend() to attacker-controlled JSON; deployments that only call the function with hardcoded data carry negligible risk, while those parsing untrusted request bodies do not.

An attacker sends a crafted HTTP POST request with the JSON body {"__proto__":{"isAdmin":true}} to any endpoint that parses the body and passes it to deepExtend() on versions ≤ 4.4.0. The function merges the payload recursively without filtering the __proto__ key, silently modifying Object.prototype so that every subsequent plain object literal in the process inherits isAdmin: true. If the application evaluates if (req.user.isAdmin) using a plain object lookup, the attacker gains elevated privileges without valid credentials. A public proof-of-concept demonstrating this vector is linked in GitHub issue #213.