GitHub Advisoryadvisory · npm

GHSA-3jc6-6r48-v6qf Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization

MEDIUM Published 2026-04-20 Modified 2026-04-23 Official page ↗
Aliases
CVE-2026-6594
Ecosystem
npm
Packages
@brikcss/merge
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-1321, CWE-94
Reviewed
2026-04-23

Affected packages

• npm @brikcss/merge: <= 1.3.1 (no fix yet)

Description

A Prototype Pollution vulnerability was determined in brikcss merge up to 1.3.0. Executing a manipulation of the argument __proto__/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

Related

Alias · CVE (1)

  • CVE-2026-6594 A vulnerability was determined in brikcss merge up to 1.3.0. vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-94 Improper Control of Generation of Code weakness

References