Phaser3 Rex Notes
Monthly
Prototype pollution in rexrainbow/phaser3-rex-notes up to version 1.80.17 allows remote authenticated attackers with low privileges to manipulate JavaScript object prototype attributes via a crafted key argument to the SetValue function in the BehaviorTree Blackboard Data Interface. Exploitation can result in low-level confidentiality disclosure, integrity modification, and availability disruption, consistent with classic prototype pollution impact on downstream object behavior. No public exploit code has been confirmed at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Prototype pollution in rexrainbow/phaser3-rex-notes up to version 1.80.17 allows remote authenticated attackers with low privileges to manipulate JavaScript object prototype attributes via a crafted key argument to the SetValue function in the BehaviorTree Blackboard Data Interface. Exploitation can result in low-level confidentiality disclosure, integrity modification, and availability disruption, consistent with classic prototype pollution impact on downstream object behavior. No public exploit code has been confirmed at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.