This vulnerability in brikcss merge (up to version 1.3.0) allows an attacker to manipulate the __proto__, constructor.prototype, or prototype arguments, leading to improper modification of object prototype attributes. Such prototype pollution can cause unexpected behavior in applications using the affected library. The vulnerability is remotely exploitable without privileges or user interaction. No vendor response or patch is available at this time.

Successful exploitation allows an attacker to modify object prototype attributes in the affected library, potentially leading to altered application behavior or security bypasses depending on how the library is used. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts. No known exploits are reported in the wild.

No official fix or patch is currently available, and the vendor has not responded to the disclosure. Users should monitor the vendor's communications for any future updates. Until a patch is released, consider avoiding use of affected versions or applying custom code-level mitigations to prevent prototype pollution if feasible.