CVE-2026-78179: Improperly Controlled Modification of Object Prototype Attributes in rexrainbow phaser3-rex-notes

This vulnerability affects the SetValue function in the file plugins/utils/object/SetValue.js of the BehaviorTree Blackboard Data Interface component in rexrainbow phaser3-rex-notes versions up to 1.80.17. Improper handling of the argument key allows attackers to modify object prototype attributes in an uncontrolled manner. The vulnerability can be exploited remotely. The CVSS 4.0 score is 5.3 (medium), indicating a network attack vector with low complexity and no user interaction required, but requiring low privileges. There is no information about known exploits in the wild or vendor patches.

An attacker can remotely manipulate the argument key to improperly modify object prototype attributes, which may lead to unexpected behavior or security issues in applications using the affected component. The impact is rated medium severity with a CVSS score of 5.3. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should monitor vendor communications for updates and consider restricting access to vulnerable components if possible.