Skip to content
OpenAdvisories

Vendor

airjp73

2 known vulnerabilities.

Products

rvf 1 @rvf/set-get 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-112309

    @rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methods

    @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwn…

    airjp73 @rvf/set-get
  • High 8.2
    CVE-2026-44483

    RVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)

    RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys __pr…

    airjp73 @rvf rvf set-get npm