CVE-2026-112309: @rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methods
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using @rvf/set-get versions before 7.0.4 are affected when untrusted form fields are parsed through @rvf/core. The vulnerable path is reachable through form parsing rather than requiring authentication.
What does an attacker need to send to trigger the denial of service?
An attacker can submit a form field named hasOwnProperty.call. This causes setPath to overwrite a property of a shared built-in function through inherited Object.prototype methods.
What is the operational impact after exploitation?
The overwritten shared function property can cause a process-wide denial of service. The affected process remains unavailable until it is restarted.
What should be done if an affected version is in use?
Upgrade @rvf/set-get to version 7.0.4 or later. Until upgrading, prevent untrusted form submissions from reaching the affected @rvf/core form-parsing path where possible.