@rvf/set-get CVE-2026-112309

Exploitation requires the target application to use @rvf/core form parsing (the native-form-data flatten path) with @rvf/set-get before 7.0.4, feeding attacker-controlled form field names into setPath. The concrete trigger is a form field whose name is a dotted path into an inherited Object.prototype method - specifically 'hasOwnProperty.call' (or toString/valueOf/isPrototypeOf/propertyIsEnumerable/toLocaleString) - causing setPath to resolve and overwrite the shared built-in function. No authentication, user interaction, or non-default configuration is required (PR:N/UI:N). The principal limiting factor is deployment scope: only applications that actually route untrusted form input through the vulnerable @rvf parsing stack are affected, and the resulting impact is limited to a recoverable process-wide crash rather than code execution or data exposure.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 (High) and is internally consistent with the description: a remote, unauthenticated attacker needs only to submit a specially-named form field, with no user interaction or special attack requirements. Critically, the impact is confined to availability (VA:H) with VC:N/VI:N - this is a denial-of-service-only prototype pollution, NOT remote code execution or data compromise, which materially lowers real-world severity despite the high score. No EPSS score was provided in the input, so exploitation-likelihood cannot be quantified. KEV status is negative and no public exploit was supplied (the commit contains only vendor regression tests, which demonstrate the mechanism but are not weaponized exploit code), so exploitation status is 'no public exploit identified at time of analysis.' The signals are not conflicting: all point to an easily-triggered but availability-limited flaw. The practical priority is moderate - trivial to trigger against any exposed app that parses untrusted form field names through @rvf/core, but the worst outcome is a process crash requiring restart, not compromise. Patch availability and a credible reporter (VulnCheck) support prompt but not emergency remediation.

An attacker targets a web application that uses @rvf/core (Remix Validated Form) to parse multipart/form submissions backed by @rvf/set-get before 7.0.4. They POST a form containing a field literally named 'hasOwnProperty.call'; the flatten/setPath logic descends into the inherited Object.prototype method and overwrites the shared function, breaking it process-wide and crashing or hanging request handling until the Node.js process is restarted. No public exploit code was identified, but the mechanism is trivial and documented in the vendor regression tests.