CVE-2026-6594: brikcss merge Prototype Pollution Vulnerability

The National Vulnerability Database has disclosed CVE-2026-6594, a high-severity (CVSS 7.3) vulnerability affecting brikcss merge up to version 1.3.0. This flaw, categorized under CWE-94 (Improper Control of Generation of Code (‘Code Injection’)) and CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’)), allows remote attackers to improperly modify object prototype attributes. The specific vector involves manipulating the __proto__/constructor.prototype/prototype argument.

This is a classic prototype pollution issue, a dangerous vulnerability that can lead to arbitrary code execution, denial of service, or property injection in JavaScript applications. The fact that it’s remotely exploitable without authentication (AV:N/AC:L/PR:N/UI:N) significantly broadens its attack surface. Defenders need to recognize that these types of vulnerabilities, while often found in less prominent libraries, can be chained with other flaws to achieve critical impact.

The National Vulnerability Database notes that the vendor was contacted but did not respond. This lack of vendor engagement is concerning, leaving users in a difficult position. Organizations relying on brikcss merge must assume this vulnerability will remain unpatched, necessitating immediate mitigation strategies or a transition to alternative, actively maintained libraries.