CVE-2026-78179

Name of the Vulnerable Software and Affected Versions rexrainbow phaser3-rex-notes versions prior to 1.80.18

Description A remote attack is possible through the BehaviorTree Blackboard Data Interface component. Specifically, the SetValue() function within the plugins/utils/object/SetValue.js file is susceptible to prototype pollution, where manipulation of the key argument allows for the improperly controlled modification of object prototype attributes.

Recommendations Update rexrainbow phaser3-rex-notes to version 1.80.18 or later. As a temporary mitigation, restrict the use of the SetValue() function until the update is applied.