This vulnerability affects the SetValue function in the file plugins/utils/object/SetValue.js of the BehaviorTree Blackboard Data Interface component in rexrainbow phaser3-rex-notes versions 1.80.0 through 1.80.17. Improper handling of the argument key allows an attacker to modify object prototype attributes in an uncontrolled manner. The attack vector is remote network access, with low attack complexity and no user interaction required. The CVSS 4.0 base score is 5.3, indicating medium severity. No known exploits are reported in the wild, and no vendor advisory or patch information is available at this time.

Successful exploitation could allow an attacker with low privileges to remotely manipulate object prototype attributes, potentially leading to unexpected behavior or security issues in applications using the affected library. The impact is rated as medium severity based on the CVSS score of 5.3. There is no indication of privilege escalation or complete system compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor vendor communications for updates. Until a fix is available, cautious use of the affected function and limiting exposure to untrusted inputs may reduce risk.