@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods.
CVSS 4.0HIGH 8.7·Network·No auth·No interaction·EPSS 0.00395·Published 2026-10-19·Fixed in 7.0.4CWE-1321