Summary
generated automatically from NVD dataThe @rvf/set-get library before 7.0.4 has a prototype pollution flaw in its setPath function, which can be reached through inherited Object.prototype methods. An unauthenticated attacker can submit a form field named hasOwnProperty.call via @rvf/core form parsing, overwriting a property of a shared built-in function. This causes a process-wide denial of service that lasts until the application is restarted. The flaw is rated 7.5 (HIGH, CVSS v3.1) and is classified as CWE-1321.
NVD description
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart.
EPSS · FIRST.org
0.40%probability of exploitation in the next 30 days
Higher than 32% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-20, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 19 oct. 2026
- Updated
- 19 oct. 2026
- Status
- Deferred
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (4)
Similar CVEs
Other vulnerabilities of type CWE-1321
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.