CVE-2026-44483
CVE-2026-44483 · RVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys __proto__, constructor, or prototype when walking a path. Because field names in submitted form data are passed directly to setPath via preprocessFormData (and through parseFormData / validate), an attacker who can submit a form to a Remix / React Router app using the library can set arbitrary properties on Object.prototype of the running server process. This is a default-reachable prototype pollution primitive: no special configuration is required. Any endpoint that accepts a form via parseFormData or runs a validator created with createValidator is affected. This vulnerability is fixed in 6.0.4 and 7.0.2.
CVSS 8.2 · Alta · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
rvf
- Versiones
- >= 7.0.0, < 7.0.2: Afectada
- >= 6.0.0, < 6.0.4: Afectada
Sin corrección publicada
set-get
- Versiones
- >= 7.0.0, < 7.0.2: Afectada
- >= 6.0.0, < 6.0.4: Afectada
Sin corrección publicada
@rvf/set-get npm
- Intervalos de versiones afectados
- SEMVER: ≥ 7.0.0, < 7.0.2
Actualiza a 7.0.2
@rvf/set-get npm
- Intervalos de versiones afectados
- SEMVER: ≥ 6.0.0, < 6.0.4
Actualiza a 6.0.4