CVE-2026-44483

RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys __proto__, constructor, or prototype when walking a path. Because field names in submitted form data are passed directly to setPath via preprocessFormData (and through parseFormData / validate), an attacker who can submit a form to a Remix / React Router app using the library can set arbitrary properties on Object.prototype of the running server process. This is a default-reachable prototype pollution primitive: no special configuration is required. Any endpoint that accepts a form via parseFormData or runs a validator created with createValidator is affected. This vulnerability is fixed in 6.0.4 and 7.0.2.

• CWE-1321

• https://github.com/airjp73/rvf/security/advisories/GHSA-c567-44rc-m5hq
• https://github.com/airjp73/rvf/security/advisories/GHSA-c567-44rc-m5hq

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44475Ella Core is a 5G core designed for private networks. Prior …6.1
• CVE-2026-44477CloudNativePG is a platform designed to manage PostgreSQL da…9.9
• CVE-2026-44478hoppscotch is an open source API development ecosystem. The …7.5
• CVE-2026-44479Vercel’s AI Cloud is a unified platform for building modern …5.5
• CVE-2026-4448Heap buffer overflow in ANGLE in Google Chrome prior to 146.…8.8
• CVE-2026-44482soundcloud-rpc is a SoundCloud Client with Discord Rich Pres…9.6
• CVE-2026-44484PyTorch Lightning is a deep learning framework to pretrain a…9.8
• CVE-2026-44486Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2026-44487Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2026-44488Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2026-44489Axios is a promise based HTTP client for the browser and Nod…5.3
• CVE-2026-4449Use after free in Blink in Google Chrome prior to 146.0.7680…8.8