{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3arvfset-get/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rvf:set-get:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-112309"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@rvf/set-get (\u003c 7.0.4)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["rvf"],"content_html":"\u003cp\u003eThe @rvf/set-get library before version 7.0.4 contains a prototype pollution vulnerability within its setPath function. This flaw allows unauthenticated attackers to manipulate the prototype chain of built-in JavaScript objects. By submitting crafted input through form parsing mechanisms in @rvf/core, an attacker can target and overwrite properties of shared built-in functions, such as hasOwnProperty.call. When successfully exploited, this manipulation corrupts the execution context of the application, leading to a process-wide denial of service that requires a full application restart to resolve. This vulnerability is significant for web applications utilizing these libraries for form handling, as it enables an unauthenticated remote attacker to crash service availability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a web application utilizing @rvf/set-get (\u0026lt; 7.0.4) and @rvf/core for form input processing.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP request containing a specially named form field, such as 'hasOwnProperty.call'.\u003c/li\u003e\n\u003cli\u003eThe @rvf/core component parses the incoming form data and passes the fields to the vulnerable setPath function within @rvf/set-get.\u003c/li\u003e\n\u003cli\u003eThe setPath function fails to properly sanitize the input, allowing the attacker-controlled key to traverse the prototype chain.\u003c/li\u003e\n\u003cli\u003eThe library performs an assignment that overwrites a shared built-in function property on Object.prototype.\u003c/li\u003e\n\u003cli\u003eSubsequent application logic attempting to use the corrupted built-in function fails.\u003c/li\u003e\n\u003cli\u003eThe application encounters a critical runtime error due to the corrupted prototype, resulting in a process-wide denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a persistent denial of service (DoS) for the affected application instance. The vulnerability allows an unauthenticated remote attacker to disrupt availability by crashing the server process. Because the corruption occurs on the global Object.prototype, the impact is process-wide, rendering the application unstable until it is manually restarted by administrators.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the @rvf/set-get library to version 7.0.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit applications using @rvf/core to ensure that input validation is performed before data is passed to helper libraries, as a defense-in-depth measure against prototype pollution.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for unexpected crashes or errors related to missing or corrupted built-in JavaScript functions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T18:08:48Z","date_published":"2026-10-19T18:08:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rvf-prototype-pollution/","summary":"The @rvf/set-get library prior to version 7.0.4 is vulnerable to prototype pollution, allowing unauthenticated attackers to trigger a process-wide denial of service via malicious form field submissions.","title":"Prototype Pollution Vulnerability in @rvf/set-get","url":"https://feed.craftedsignal.io/briefs/2026-10-rvf-prototype-pollution/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:rvf:set-Get:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}