CVE-2026-78181

A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component Keypath Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS v3 7.3 HIGH
CVSS v2.0 7.5 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/ractivejs/ractive/
https://github.com/ractivejs/ractive/issues/3448
https://vuldb.com/cve/CVE-2026-78181
https://vuldb.com/submit/884187
https://vuldb.com/vuln/394565
https://vuldb.com/vuln/394565/cti

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Se ha identificado una debilidad en ractivejs ractive hasta la versión 1.4.4. La función afectada es Ractive#set del componente Gestor de Keypath. La ejecución de una manipulación puede llevar a una modificación indebidamente controlada de atributos de prototipos de objetos. El ataque puede lanzarse de forma remota. El exploit ha sido puesto a disposición del público y podría usarse para ataques. El proyecto fue informado del problema con antelación mediante un informe de incidencia, pero aún no ha respondido.

Information

Published : 2026-08-24 04:16

Updated : 2026-10-12 16:10

NVD link : CVE-2026-78181

Mitre link : CVE-2026-78181

CVE.ORG link : CVE-2026-78181

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2026-78181", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78181", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T18:12:03.169241Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:ractivejs:ractive:*:*:*:*:*:*:*:*"], "vendor": "ractivejs", "modules": ["Keypath Handler"], "product": "ractive", "versions": [{"status": "affected", "version": "1.4.0"}, {"status": "affected", "version": "1.4.1"}, {"status": "affected", "version": "1.4.2"}, {"status": "affected", "version": "1.4.3"}, {"status": "affected", "version": "1.4.4"}]}]}], "published": "2026-08-24T04:16:58.847", "references": [{"url": "https://github.com/ractivejs/ractive/", "source": "cna@vuldb.com"}, {"url": "https://github.com/ractivejs/ractive/issues/3448", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-78181", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/884187", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/394565", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/394565/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component Keypath Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se ha identificado una debilidad en ractivejs ractive hasta la versi\u00f3n 1.4.4. La funci\u00f3n afectada es Ractive#set del componente Gestor de Keypath. La ejecuci\u00f3n de una manipulaci\u00f3n puede llevar a una modificaci\u00f3n indebidamente controlada de atributos de prototipos de objetos. El ataque puede lanzarse de forma remota. El exploit ha sido puesto a disposici\u00f3n del p\u00fablico y podr\u00eda usarse para ataques. El proyecto fue informado del problema con antelaci\u00f3n mediante un informe de incidencia, pero a\u00fan no ha respondido."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "cna@vuldb.com"}