{"id":"EUVD-2026-32564","enisaUuid":"5b1cd777-fb3e-38da-b71a-d50ca80d8735","description":"RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys __proto__, constructor, or prototype when walking a path. Because field names in submitted form data are passed directly to setPath via preprocessFormData (and through parseFormData / validate), an attacker who can submit a form to a Remix / React Router app using the library can set arbitrary properties on Object.prototype of the running server process. This is a default-reachable prototype pollution primitive: no special configuration is required. Any endpoint that accepts a form via parseFormData or runs a validator created with createValidator is affected. This vulnerability is fixed in 6.0.4 and 7.0.2.","datePublished":"May 27, 2026, 3:20:43 PM","dateUpdated":"May 27, 2026, 6:48:41 PM","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","references":"https://github.com/airjp73/rvf/security/advisories/GHSA-c567-44rc-m5hq\n","aliases":"CVE-2026-44483\nGHSA-c567-44rc-m5hq\n","assigner":"GitHub_M","epss":0.36,"enisaIdProduct":[{"id":"10e9ef84-9a67-3d7c-a11e-8a48be8a16a8","product":{"name":"set-get","vendor":{"name":"@rvf"}},"product_version":"6.0.0, \u003c 6.0.4"},{"id":"4776201d-ab84-3eb8-9bb9-66c609450c63","product":{"name":"set-get","vendor":{"name":"@rvf"}},"product_version":"7.0.0, \u003c 7.0.2"},{"id":"61ffccfb-f390-3779-845e-3806231de927","product":{"name":"rvf","vendor":{"name":"airjp73"}},"product_version":"7.0.0, \u003c 7.0.2"},{"id":"a8e7a82a-f160-3c67-b214-ed23dc69af76","product":{"name":"rvf","vendor":{"name":"airjp73"}},"product_version":"6.0.0, \u003c 6.0.4"}],"enisaIdVendor":[{"id":"299a8fed-3dd3-3b32-bc75-a9e334f1170c","vendor":{"name":"@rvf"}},{"id":"943495f6-5206-3aad-88f2-d4d280af88a8","vendor":{"name":"airjp73"}}],"enisaIdVulnerability":[{"id":"f103e1cb-658b-3f3f-aaad-c762493db230","vulnerability":{"id":"GHSA-c567-44rc-m5hq","description":"@rvf/set-get has a prototype pollution issue that\u0027s reachable via @rvf/core preprocessFormData (HTTP form data)","datePublished":"May 11, 2026, 4:09:40 PM","dateUpdated":"Jun 8, 2026, 11:49:03 PM","baseScore":0.0,"references":"https://github.com/airjp73/rvf/security/advisories/GHSA-c567-44rc-m5hq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44483\nhttps://github.com/airjp73/rvf\n","enisa_id":"EUVD-2026-32564\n","aliases":"CVE-2026-44483\nGHSA-c567-44rc-m5hq\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f66b2261-3777-3291-9e10-966e653a3b6b","vulnerability":{"id":"CVE-2026-44483","description":"RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys __proto__, constructor, or prototype when walking a path. Because field names in submitted form data are passed directly to setPath via preprocessFormData (and through parseFormData / validate), an attacker who can submit a form to a Remix / React Router app using the library can set arbitrary properties on Object.prototype of the running server process. This is a default-reachable prototype pollution primitive: no special configuration is required. Any endpoint that accepts a form via parseFormData or runs a validator created with createValidator is affected. This vulnerability is fixed in 6.0.4 and 7.0.2.","datePublished":"May 27, 2026, 3:20:43 PM","dateUpdated":"May 27, 2026, 6:48:41 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","references":"https://github.com/airjp73/rvf/security/advisories/GHSA-c567-44rc-m5hq\n","enisa_id":"EUVD-2026-32564\n","assigner":"GitHub_M","epss":0.36,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"1c24e233-bf9a-3396-8d94-9625b11ce605","product":{"name":"rvf","vendor":{"name":"airjp73"}},"product_version":"7.0.0, \u003c 7.0.2"},{"id":"b35111f6-c82c-3a4a-9bf5-41f556cba1a3","product":{"name":"set-get","vendor":{"name":"@rvf"}},"product_version":"7.0.0, \u003c 7.0.2"},{"id":"e500bbb2-10b6-35f2-8a95-732bde215455","product":{"name":"rvf","vendor":{"name":"airjp73"}},"product_version":"6.0.0, \u003c 6.0.4"},{"id":"feadc6fb-5e8d-3b40-bb20-4f2534e269e2","product":{"name":"set-get","vendor":{"name":"@rvf"}},"product_version":"6.0.0, \u003c 6.0.4"}],"vulnerabilityVendor":[{"id":"2a2f793c-704f-3c4b-b342-99bfbb713e79","vendor":{"name":"@rvf"}},{"id":"372debc4-92ec-32e7-9bbe-0b5706e073c8","vendor":{"name":"airjp73"}}]}}],"enisaIdAdvisory":[]}