CVE-2026-44483 Details
Description
RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys __proto__, constructor, or prototype when walking a path. Because field names in submitted form data are passed directly to setPath via preprocessFormData (and through parseFormData / validate), an attacker who can submit a form to a Remix / React Router app using the library can set arbitrary properties on Object.prototype of the running server process. This is a default-reachable prototype pollution primitive: no special configuration is required. Any endpoint that accepts a form via parseFormData or runs a validator created with createValidator is affected. This vulnerability is fixed in 6.0.4 and 7.0.2.
A prototype pollution vulnerability has been identified in RVF (Remix Validated Form) versions 6.0.0 prior to 6.0.4 and 7.0.2. The issue arises in the '@rvf/set-get' package, which is utilized by '@rvf/core' to organize incoming form data into a nested structure. The 'setPath' function fails to restrict certain keys—'__proto__', 'constructor', and 'prototype'—when traversing a path. This oversight allows an attacker to manipulate properties on the Object.prototype of the server process through submitted form data. The vulnerability is automatically exploitable without any special configuration, affecting any endpoint that processes forms with 'parseFormData' or uses validators created with 'createValidator'.
Users can upgrade to '@rvf/set-get' versions 7.0.2 or 6.0.4. If direct upgrading of '@rvf/core' is not possible, an 'npm' or 'pnpm' override can be applied to '@rvf/set-get'.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/airjp73/rvf/security/advisories/GHSA-c567-44rc-m5hq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/airjp73/rvf/security/advisories/GHSA-c567-44rc-m5hq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| RVF | >= 6.0.0, < 6.0.4 (semver) >= 7.0.0, < 7.0.2 (semver) |
CPE
Remediation
| |
| RVF setPath | All versions |
CPE
Remediation
| |
| RVF set-get | < 7.0.2 (semver) < 6.0.4 (semver) |
CPE
Remediation
| |
| RVF core | 8.1.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |