Read the docs
TI-2026-32420 Aliases CVE-2026-44483GHSA-c567-44rc-m5hq

RVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)

Priority HIGH 75CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys __proto__, constructor, or prototype when walking a path. Because field names in submitted form data are passed directly to setPath via preprocessFormData (and through parseFormData / validate), an attacker who can submit a form to a Remix / React Router app using the library can set arbitrary properties on Object.prototype of the running server process. This is a default-reachable prototype pollution primitive: no special configuration is required. Any endpoint that accepts a form via parseFormData or runs a validator created with createValidator is affected. This vulnerability is fixed in 6.0.4 and 7.0.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00359 29th percentileScored 2026-11-07
Fix Fixed rvf (airjp73): 7.0.2, 6.0.4set-get (@rvf): 7.0.2, 6.0.4+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
airjp73rvf7.0.0 to before 7.0.2; 6.0.0 to before 6.0.47.0.2, 6.0.4Patch availableCNA
@rvfset-get7.0.0 to before 7.0.2; 6.0.0 to before 6.0.47.0.2, 6.0.4Patch availableCNA
—@rvf/set-get (npm)7.0.0 to before 7.0.27.0.2Patch availableGHSA-c567-44rc-m5hq
—@rvf/set-get (npm)6.0.0 to before 6.0.46.0.4Patch availableGHSA-c567-44rc-m5hq
  • rvf Vendorairjp73 Affected 7.0.0 to before 7.0.2; 6.0.0 to before 6.0.4 Fixed in 7.0.2, 6.0.4 Patch available CNA
  • set-get Vendor@rvf Affected 7.0.0 to before 7.0.2; 6.0.0 to before 6.0.4 Fixed in 7.0.2, 6.0.4 Patch available CNA
  • @rvf/set-get (npm) Vendor— Affected 7.0.0 to before 7.0.2 Fixed in 7.0.2 Patch available GHSA-c567-44rc-m5hq
  • @rvf/set-get (npm) Vendor— Affected 6.0.0 to before 6.0.4 Fixed in 6.0.4 Patch available GHSA-c567-44rc-m5hq

Remediation

  • Fix · CNA rvf (airjp73) Fixed in 7.0.2, 6.0.4
  • Fix · CNA set-get (@rvf) Fixed in 7.0.2, 6.0.4
  • Fix · GHSA-c567-44rc-m5hq @rvf/set-get (npm) Fixed in 7.0.2 Advisory →
  • Fix · GHSA-c567-44rc-m5hq @rvf/set-get (npm) Fixed in 6.0.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44483
  2. 2026-10-03 Alias added: GHSA-c567-44rc-m5hq

References

Advisory 1

Other 2

  • TI-2026-76503 @rvf/set-get setPath prototype pollution enables denial of service CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences