CVE-2026-78181: Improperly Controlled Modification of Object Prototype Attributes in ractivejs ractive

This vulnerability in ractivejs ractive up to version 1.4.4 involves improper control over modification of object prototype attributes via the Ractive#set function in the Keypath Handler component. The flaw can be exploited remotely without privileges or user interaction, potentially leading to partial impact on confidentiality, integrity, and availability. The issue was reported early to the project, but no fix or response has been issued. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation can lead to unauthorized modification of object prototype attributes, which may affect application behavior and security. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. No known active exploitation in the wild has been reported yet.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a patch is released, consider applying application-level mitigations such as input validation or restricting usage of the vulnerable function if feasible. Exercise caution with untrusted input that may reach the Ractive#set function.