{"id":"EUVD-2026-32564","revision":"63e0c7f6cae740d199ab07ba3c22b2f6","records":[{"revision":"63e0c7f6cae740d199ab07ba3c22b2f6","observedAt":"2026-11-05T09:56:07.967+00:00","statement":{"source":"euvd","id":"EUVD-2026-32564","aliases":["CVE-2026-44483","GHSA-c567-44rc-m5hq"],"title":"RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not …","description":"RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys __proto__, constructor, or prototype when walking a path. Because field names in submitted form data are passed directly to setPath via preprocessFormData (and through parseFormData / validate), an attacker who can submit a form to a Remix / React Router app using the library can set arbitrary properties on Object.prototype of the running server process. This is a default-reachable prototype pollution primitive: no special configuration is required. Any endpoint that accepts a form via parseFormData or runs a validator created with createValidator is affected. This vulnerability is fixed in 6.0.4 and 7.0.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","score":8.2,"severity":null}],"references":["https://github.com/airjp73/rvf/security/advisories/GHSA-c567-44rc-m5hq"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32564","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 27, 2026, 3:20:43 PM","dateUpdated":"May 27, 2026, 6:48:41 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-32564","identifiers":["EUVD-2026-32564","CVE-2026-44483","GHSA-c567-44rc-m5hq"]},"retained":false,"historicalAffected":[]}],"coverage":[]}