Merge EUVD-2026-23742

Exploitation requires the target application to use brikcss merge library versions 1.0 through 1.3.0 AND process attacker-controlled input through merge operations without sanitizing prototype chain-related keys (__proto__, constructor.prototype, prototype). Vulnerable code patterns include: merging user-submitted JSON/form data into configuration objects, processing API request bodies with merge functions, or integrating third-party data sources into application state. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, user interaction, or special network position is required - default configurations are exploitable if the library is in use with external data ingestion. Limiting factors: applications that validate input keys against an allowlist, use Object.create(null) for merged targets, or employ frozen prototypes are NOT vulnerable. Exploitation impact depends on how polluted properties propagate through application logic: highest risk in authentication/authorization code paths, configuration management, or template rendering engines.

Real-world risk is MODERATE-TO-HIGH despite the 7.3 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote exploitation requiring no authentication or user interaction, with low attack complexity - favorable conditions for attackers. However, actual impact (C:L/I:L/A:L) is rated low across all CIA triad dimensions because prototype pollution's severity depends heavily on application-specific context: how polluted properties propagate through the codebase. The publicly available PoC from sudo-secure on GitHub confirms exploitability is proven, lowering the barrier to weaponization. No CISA KEV listing suggests this is not yet observed in widespread active exploitation, likely because brikcss merge has a smaller user base compared to mainstream libraries. EPSS data is not provided, limiting probability assessment. Key risk factors: (1) vendor non-responsiveness means no official patch or advisory exists; (2) the library appears unmaintained; (3) transitive dependencies could expose larger applications unknowingly. Organizations using this library in externally-facing applications processing untrusted input face immediate risk. The SSVC technical impact is likely PARTIAL (can affect application security boundaries) and automatable (straightforward exploitation via HTTP payloads). Priority: HIGH for environments using affected versions with external data ingestion; MEDIUM for internal-only deployments with input validation.

An attacker identifies a web application using brikcss merge 1.3.0 to process user-submitted JSON configuration data. They craft a malicious HTTP POST request containing a payload like {"__proto__": {"isAdmin": true}} or {"constructor": {"prototype": {"authenticated": true}}}. When the application merges this untrusted input with existing objects, the injected properties pollute Object.prototype globally. Subsequent authorization checks or privilege validations that rely on object properties (e.g., if(user.isAdmin)) now inherit the attacker's injected values, enabling authentication bypass or privilege escalation. Alternatively, the attacker injects properties that cause denial of service when accessed or leak sensitive configuration data through error messages. Public PoC code from sudo-secure provides ready-to-use exploitation templates, significantly lowering attacker skill requirements.