CVE-2026-6594

CVE-2026-6594 is a prototype pollution vulnerability affecting brikcss merge library versions up to 1.3.0. The flaw allows attackers to manipulate the __proto__, constructor.prototype, or prototype properties, resulting in improperly controlled modification of object prototype attributes. This vulnerability can be exploited remotely without authentication or user interaction, making it broadly accessible. The vulnerability carries a CVSS score of 7.3 (HIGH) with a network-based attack vector and low attack complexity. Successful exploitation could result in limited impacts across confidentiality, integrity, and availability. The EPSS score of 0.0004 indicates minimal real-world exploitation probability compared to other disclosed vulnerabilities. There is currently no evidence of active exploitation, and the vulnerability has not been designated as a known exploited vulnerability (KEV) by CISA. Community attention remains low, as reflected by its inactive status on threat tracking lists. The vendor was contacted early but provided no response regarding remediation efforts. Organizations using brikcss merge should consider upgrading beyond version 1.3.0 when patches become available.