A vulnerability was determined in jQWidgets up to 24.0.1. (CVE-2026-78178)
A vulnerability exists in jQWidgets up to version 24.0.1 affecting the JQXLite.extend and jqxBaseFramework.extend functions in the jqwidgets/jqx-all.js file. This flaw allows improper modification of object prototype attributes and can be exploited remotely without authentication. The issue is tracked as CVE-2026-78178 and has a CVSS score of 7.3 (medium severity). The related GitHub issue was closed with a "not planned" label, indicating no official fix is currently planned.
AI Analysis
Technical Summary
The vulnerability in jQWidgets (up to 24.0.1) involves improper control over object prototype attribute modification within the JQXLite.extend and jqxBaseFramework.extend functions of the jqwidgets/jqx-all.js file. This can be exploited remotely without authentication or user interaction. The underlying weakness is classified as CWE-94 (Improper Control of Generation of Code). The GitHub issue tracking this vulnerability was closed with a 'not planned' label, indicating no official fix is currently provided.
Potential Impact
Successful exploitation could lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). This means an attacker could potentially manipulate object prototypes remotely, which may result in unauthorized code execution or application behavior modification. However, no known exploits are reported in the wild.
Mitigation Recommendations
No official patch or fix is currently planned or available for this vulnerability as per the vendor's GitHub issue closure. Users should evaluate the risk of continued use of affected versions and consider alternative mitigations such as avoiding use of the vulnerable functions or applying custom code-level safeguards. Patch status is not yet confirmed — check the vendor advisory or project repository for any updates.
A vulnerability was determined in jQWidgets up to 24.0.1. (CVE-2026-78178)
Description
A vulnerability exists in jQWidgets up to version 24.0.1 affecting the JQXLite.extend and jqxBaseFramework.extend functions in the jqwidgets/jqx-all.js file. This flaw allows improper modification of object prototype attributes and can be exploited remotely without authentication. The issue is tracked as CVE-2026-78178 and has a CVSS score of 7.3 (medium severity). The related GitHub issue was closed with a "not planned" label, indicating no official fix is currently planned.
CVSS v3.1
Score 7.3high
Affected software
pkg:github/jqwidgets/jQWidgetsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in jQWidgets (up to 24.0.1) involves improper control over object prototype attribute modification within the JQXLite.extend and jqxBaseFramework.extend functions of the jqwidgets/jqx-all.js file. This can be exploited remotely without authentication or user interaction. The underlying weakness is classified as CWE-94 (Improper Control of Generation of Code). The GitHub issue tracking this vulnerability was closed with a 'not planned' label, indicating no official fix is currently provided.
Potential Impact
Successful exploitation could lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). This means an attacker could potentially manipulate object prototypes remotely, which may result in unauthorized code execution or application behavior modification. However, no known exploits are reported in the wild.
Mitigation Recommendations
No official patch or fix is currently planned or available for this vulnerability as per the vendor's GitHub issue closure. Users should evaluate the risk of continued use of affected versions and consider alternative mitigations such as avoiding use of the vulnerable functions or applying custom code-level safeguards. Patch status is not yet confirmed — check the vendor advisory or project repository for any updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-hhpq-pm9g-crh9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-78178"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a8c4c75acd9273b499c0e66
Added to database: 08/24/2026, 13:51:49 UTC
Last enriched: 08/24/2026, 14:29:33 UTC
Last updated: 08/25/2026, 04:51:59 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.