PatchSiren cyber security CVE debrief

CVE-2026-44483 airjp73 CVE debrief

## Summary A prototype pollution vulnerability in RVF (Remix Validated Form) allows attackers to pollute Object.prototype by submitting crafted form data with keys like `__proto__`, `constructor`, or `prototype`. The `setPath` function in `@rvf/set-get` fails to block these dangerous keys when flattening form data, enabling arbitrary property injection on the server. This is default-reachable: any endpoint using `parseFormData` or `createValidator` is affected without special configuration. ## Affected Versions - `@rvf/core` / `@rvf/set-get`: 6.0.0 to 6.0.3 (fixed in 6.0.4) - `@rvf/core` / `@rvf/set-get`: 7.0.0 to 7.0.1 (fixed in 7.0.2) ## Attack Vector Remote, unauthenticated attackers can exploit this by submitting HTTP POST requests with maliciously named form fields. The vulnerability is triggered through normal form processing pipelines (`preprocessFormData` → `setPath`). ## Impact - **Confidentiality**: None direct (CVSS C:N) - **Integrity**: High (CVSS I:H) — arbitrary object property injection - **Availability**: Low (CVSS A:L) — potential application instability from prototype corruption ## Recommended Actions 1. **Upgrade immediately** to patched versions (6.0.4+ or 7.0.2+) 2. **Audit applications** for any server-side logic dependent on Object.prototype integrity 3. **Implement input validation** as defense-in-depth for form field names 4. **Review dependencies** to identify transitive usage of `@rvf/core` or `@rvf/set-get` ## Timeline - **2026-05-27**: CVE published and initial disclosure - **2026-05-27**: CVE modified (metadata update)