Skip to content
Threat Feed

Product

@Rvf/Set-Get

1 brief RSS
high advisory

@rvf/set-get Prototype Pollution via Form Data Processing (CVE-2026-44483)

The `@rvf/set-get` library, used by `@rvf/core`, is vulnerable to prototype pollution via form data processing; the `setPath` function does not block the keys `__proto__`, `constructor`, or `prototype` when walking a path, allowing attackers to set arbitrary properties on `Object.prototype` of the running server process via HTTP form submissions (CVE-2026-44483).

@rvf/set-get +1 prototype-pollution web-application javascript
2r 1t