Vulnerability · Published May 27, 2026 · Assigned by GitHub_M

CVE-2026-44483RVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)

High 8.2

In plain English

A high-severity prototype pollution in rvf from airjp73. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.4%top 70.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys __proto__, constructor, or prototype when walking a path. Because field names in submitted form data are passed directly to setPath via preprocessFormData (and through parseFormData / validate), an attacker who can submit a form to a Remix / React Router app using the library can set arbitrary properties on Object.prototype of the running server process. This is a default-reachable prototype pollution primitive: no special configuration is required. Any endpoint that accepts a form via parseFormData or runs a validator created with createValidator is affected. This vulnerability is fixed in 6.0.4 and 7.0.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@rvf/set-get	7.0.2	GHSA-c567-44rc-m5hq
npm	@rvf/set-get	6.0.4	GHSA-c567-44rc-m5hq

Affected products (as reported)

Vendor	Product	Versions
airjp73	rvf	>= 7.0.0, < 7.0.2>= 6.0.0, < 6.0.4
@rvf	set-get	>= 7.0.0, < 7.0.2>= 6.0.0, < 6.0.4

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

References

https://github.com/airjp73/rvf/security/advisories/GHSA-c567-44rc-m5hq x_refsource_CONFIRM