The vulnerability is prototype pollution in the setPath function of @rvf/set-get, which does not filter the keys __proto__, constructor, or prototype when resolving a path. When form data is parsed by the library, attacker-controlled field names can be supplied directly to setPath, allowing the attacker to set arbitrary properties on Object.prototype of the server process. This flaw can lead to the execution of arbitrary code or other malicious behaviour on the server, compromising the confidentiality, integrity, and availability of the application.

The issue affects the JavaScript libraries @rvf/set-get and the airjp73:rvf bundle. Vulnerable versions are all releases from 6.0.0 up to, but not including, 6.0.4, and from 7.0.0 up to, but not including, 7.0.2. Applications using Remix or React Router that process form data through parseFormData or validators created with createValidator are impacted.

The CVSS score of 8.2 indicates high severity. The EPSS is not provided, and the vulnerability is not listed in the CISA KEV catalog, so current exploit evidence is unclear. The likely attack vector is a legitimate HTTP form submission to a Remix / React Router application that incorporates the vulnerable library, since no special configuration is required to trigger the primitive.