CVE-2026-78654

A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.1 will fix this issue. The identifier of the patch is 810398c1308c500c3b8b6af380b5a89371389327. You should upgrade the affected component.

• CWE-94
• CWE-1321

• https://github.com/cleverbrush/framework/
• https://github.com/cleverbrush/framework/commit/810398c1308c500c3b8b6af380b5a89371389327
• https://github.com/cleverbrush/framework/issues/213
• https://github.com/cleverbrush/framework/pull/215
• https://github.com/cleverbrush/framework/releases/tag/%40cleverbrush/async%404.4.1
• https://vuldb.com/cve/CVE-2026-78654
• https://vuldb.com/submit/886401
• https://vuldb.com/vuln/394866
• https://vuldb.com/vuln/394866/cti
• https://vuldb.com/submit/886401

Published

Aug 25, 2026

Last Modified

Aug 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78631The Okta Hyperdrive Agent writes the decoded SAML bearer ass…5.5
• CVE-2026-78635The Okta Privileged Access client URL handler does not inser…5
• CVE-2026-78637A vulnerability was detected in Fdawgs node-poppler up to 9.…7.3
• CVE-2026-78638A flaw has been found in peerigon unzip-crx and unzip-crx-3 …3.3
• CVE-2026-7864SEPPmail Secure Email Gateway before version 15.0.4 exposes …6.9
• CVE-2026-7865A hidden console command is vulnerable to command injection …7.4
• CVE-2026-78655Punk::Plugin::TOTP versions before 0.05 for Perl allow the s…9.1
• CVE-2026-78656A vulnerability was found in itsourcecode Sales and Inventor…6.3
• CVE-2026-78657The SigmaForms Pro – AI Generated Forms plugin for WordPress…9.8
• CVE-2026-78658IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3…6.5
• CVE-2026-7866Stack-based Buffer Overflow vulnerability in RTI Connext Pro…10
• CVE-2026-78662Previously, a channel registered in the mux's chanList is no…7.5