CVE-2026-6594

High

Published: 20 April 2026

Published

20 April 2026

Modified

22 April 2026

KEV Added

—

Patch

—

CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0006 18.2th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-6594 is a high-severity Code Injection (CWE-94) vulnerability. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and correction of flaws like the prototype pollution vulnerability in brikcss merge library, such as through patching, workarounds, or removal.

CM-10 Software Usage Restrictions good match

prevent

Restricts installation and execution of vulnerable software versions, including brikcss merge up to 1.3.0, preventing its use in systems.

SI-10 Information Input Validation partial match

prevent

Mandates validation of untrusted inputs to merge functions to block manipulation of special keys like __proto__ that enable prototype pollution.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The CVE describes a remotely exploitable prototype pollution vulnerability in a library with no authentication or user interaction required (AV:N/PR:N/UI:N), directly enabling exploitation of public-facing applications that use the affected merge library.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing a manipulation of the argument __proto__/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The…

vendor was contacted early about this disclosure but did not respond in any way.

Deeper analysisAI

CVE-2026-6594 is a prototype pollution vulnerability in the brikcss merge library up to version 1.3.0. The issue affects an unknown part of the library, where manipulation of the arguments __proto__/constructor.prototype/prototype enables improperly controlled modification of object prototype attributes. Published on 2026-04-20, it is associated with CWEs-94 and CWE-1321.

A remote attacker requires no privileges or user interaction and faces low attack complexity to exploit this vulnerability, per its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Successful exploitation allows limited impacts on confidentiality, integrity, and availability through prototype chain pollution.

The vendor was contacted early regarding this disclosure but provided no response, resulting in no official patches or mitigation advisories. Key references include a proof-of-concept at https://github.com/sudo-secure/security-research/blob/main/brikcss-merge/prototype-pollution/PoC.md and VulDB entries at https://vuldb.com/vuln/358229, https://vuldb.com/submit/791805, and https://vuldb.com/vuln/358229/cti.