This vulnerability affects the Ractive#set function of the Keypath Handler in ractivejs ractive up to version 1.4.4. An attacker can manipulate this function to improperly modify object prototype attributes, potentially leading to prototype pollution. The flaw can be exploited remotely without privileges or user interaction. Although an exploit is publicly available, there is no official remediation or patch released by the vendor as of the publication date.

Successful exploitation allows remote attackers to modify object prototype attributes improperly, which can lead to prototype pollution. This may result in unexpected behavior or security issues in applications using the affected versions of ractivejs ractive. The CVSS 4.0 base score is 6.9 (medium severity), indicating a significant but not critical risk. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. In the meantime, consider avoiding use of affected versions or applying community-provided mitigations if available.