CVE-2026-6594 - brikcss merge prototype pollution

Back Back to CVE browser

MEDIUM

brikcss merge prototype pollution

Published Apr 20, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.56%

Description

A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing a manipulation of the argument __proto__/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Brikcss Product Merge Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -
- Version
  1.1
  Status
  affected
  Constraints
  -
- Version
  1.2
  Status
  affected
  Constraints
  -
- Version
  1.3.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Brikcss

Merge

n/a

Version	Status	Constraints
1.0	affected	-
1.1	affected	-
1.2	affected	-
1.3.0	affected	-

Ecosystem	Package	Introduced	Fixed
npm	@brikcss/merge	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-1321

CWE-94

Code Injection

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23742
Advisory
https://github.com/advisories/GHSA-3jc6-6r48-v6qf
Advisory
https://github.com/sudo-secure/security-research/blob/main/brikcss-merge/prototype-pollution/PoC.md
exploit
https://nvd.nist.gov/vuln/detail/CVE-2026-6594
https://vuldb.com/submit/791805
third-party-advisory
https://vuldb.com/vuln/358229
vdb-entrytechnical-description
https://vuldb.com/vuln/358229/cti
signaturepermissions-required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23742		Advisory
https://github.com/advisories/GHSA-3jc6-6r48-v6qf		Advisory
https://github.com/sudo-secure/security-research/blob/main/brikcss-merge/prototype-pollution/PoC.md		exploit
https://nvd.nist.gov/vuln/detail/CVE-2026-6594
https://vuldb.com/submit/791805		third-party-advisory
https://vuldb.com/vuln/358229		vdb-entrytechnical-description
https://vuldb.com/vuln/358229/cti		signaturepermissions-required