CVE-2026-78654: cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.1 will fix this issue. The identifier of the patch is 810398c1308c500c3b8b6af380b5a89371389327. You should upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleverbrush framework/deepto a version that resolves this vulnerability.Fixed in 4.4.1Patch 810398c1308c500c3b8b6af380b5a89371389327
Event History
Frequently Asked Questions
Which versions should be treated as affected?
The issue affects cleverbrush framework/deep through version 4.4.0. Upgrading to version 4.4.1 fixes the vulnerability.
Can this be exploited remotely without credentials or user interaction?
Yes. The supplied severity vector indicates network reachability, low attack complexity, no required privileges, and no user interaction; the description also states that remote exploitation is possible.
Is exploit code or public exploitation information available?
Yes. The exploit has been publicly disclosed and may be used.
What should teams do if they identify the affected component?
Upgrade the affected component to version 4.4.1. The associated patch identifier is 810398c1308c500c3b8b6af380b5a89371389327.