CVE-2026-112309: falha de alta gravidade em airjp73 @rvf/set-get
@rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methods
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.4%
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
airjp73 · @rvf/set-getReferências
https://github.com/airjp73/rvf/blob/61172ff01bf1250893108e5c80f35b5ac0388ecb/packages/core/src/native-form-data/flatten.tshttps://github.com/airjp73/rvf/blob/61172ff01bf1250893108e5c80f35b5ac0388ecb/packages/set-get/src/setPath.tshttps://github.com/airjp73/rvf/commit/4a5e118667549ac41f065b4cfa80b995841c3811https://www.vulncheck.com/advisories/rvf-set-get-before-7.0.4-prototype-pollution-via-setpath-inherited-methods