Executive brief
phaser3-rex-notes is a plugin library for the Phaser 3 game engine that includes a BehaviorTree component for managing game object state. A prototype pollution vulnerability in the SetValue utility function allows attackers to modify JavaScript's Object.prototype through untrusted key paths, potentially corrupting game logic, causing denial of service, or enabling unauthorized feature flag manipulation.
Technical details
The vulnerability is a prototype pollution flaw in plugins/utils/object/SetValue.js, which accepts dotted-path key strings to set nested object properties but fails to reject prototype-related path segments (__proto__, constructor, prototype) before traversal and assignment. The vulnerable function splits the key on a delimiter, traverses intermediate objects using GetEntry(), and assigns to the final key without validating whether any segment pollutes Object.prototype. The issue is exposed through public APIs including Blackboard#set(), Blackboard#setData(), and Tree#setValue(), making it reachable when applications deserialize remote JSON-driven key paths from behavior trees, game save files, or mod configurations. An attacker with control over key names can mutate Object.prototype and inject inherited properties into all objects in the application, altering object behavior and potentially breaking security assumptions or feature flags.
Affected products
- rexrainbow phaser3-rex-notes up to 1.80.17
Timeline
- 2026-08-24: disclosed
- 2026-07-05: other: Issue opened on GitHub