@rvf vulnerabilities

Products

• set-get 2

Latest @rvf CVEs

Newest publication first

1. CVE-2026-112309 @rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methods

   Published 2026-10-19

   High·CVSS 8.7 EPSS 0.40%

   @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through...

2. CVE-2026-44483 RVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)

   Published 2026-05-27

   High·CVSS 8.2 EPSS 0.36%

   RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys proto, constructor, or pr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.