CVE-2026-112309

HighCVSS 7.5/10Last modified Oct 22, 2026

Description

@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1321

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2026
Last modified: Oct 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-112318.1Inappropriate implementation in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary CVE-2026-1123104.3docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying pla CVE-2026-1123116.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ACF Extended ACF Extended acf-extended allow CVE-2026-1123127.5Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Securi CVE-2026-1123137.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended CVE-2026-1123147.5clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote CVE-2026-1123155.3The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded bu CVE-2026-1123166.5xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows re CVE-2026-1123175.3krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-dec CVE-2026-1123186.5The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded b CVE-2026-1123196.5The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to CVE-2026-112325.4Inappropriate implementation in TabGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via malic