CVE-2026-6594
Published: 20 April 2026
Summary
CVE-2026-6594 is a medium-severity Code Injection (CWE-94) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-6594 is a prototype pollution vulnerability in the brikcss merge library up to version 1.3.0. The issue affects an unknown part of the library, where manipulation of the arguments __proto__/constructor.prototype/prototype enables improperly controlled modification of object prototype attributes. Published on 2026-04-20, it is associated with CWEs-94 and CWE-1321.
A remote attacker requires no privileges or user interaction and faces low attack complexity to exploit this vulnerability, per its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Successful exploitation allows limited impacts on confidentiality, integrity, and availability through prototype chain pollution.
The vendor was contacted early regarding this disclosure but provided no response, resulting in no official patches or mitigation advisories. Key references include a proof-of-concept at https://github.com/sudo-secure/security-research/blob/main/brikcss-merge/prototype-pollution/PoC.md and VulDB entries at https://vuldb.com/vuln/358229, https://vuldb.com/submit/791805, and https://vuldb.com/vuln/358229/cti.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23742
Vulnerability details
A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing a manipulation of the argument __proto__/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The…
more
vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remotely exploitable prototype pollution vulnerability in a library with no authentication or user interaction required (AV:N/PR:N/UI:N), directly enabling exploitation of public-facing applications that use the affected merge library.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of flaws like the prototype pollution vulnerability in brikcss merge library, such as through patching, workarounds, or removal.
Restricts installation and execution of vulnerable software versions, including brikcss merge up to 1.3.0, preventing its use in systems.
Mandates validation of untrusted inputs to merge functions to block manipulation of special keys like __proto__ that enable prototype pollution.