CVE-2026-112309CWE-1321

CVE-2026-112309

High · published October 19, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
32.6
In the wild
Unconfirmed
What it is

@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00395 · 32.6th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2026-10-19T20:17Z
References (4)
https://github.com/airjp73/rvf/blob/61172ff01bf1250893108e5c80f35b5ac0388ecb/packages/core/src/native-form-data/flatten.ts · [email protected]https://github.com/airjp73/rvf/blob/61172ff01bf1250893108e5c80f35b5ac0388ecb/packages/set-get/src/setPath.ts · [email protected]https://github.com/airjp73/rvf/commit/4a5e118667549ac41f065b4cfa80b995841c3811 · [email protected]https://www.vulncheck.com/advisories/rvf-set-get-before-7.0.4-prototype-pollution-via-setpath-inherited-methods · [email protected]
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 15:28Z
    @rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methods
    cvelistv5
  • 19 OCT 15:28Z
    @rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methods
    cvelistv5