CVE-2026-112309
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite propert
CVSS
7.5
Alta
EPSS
0.4%
p34
KEV
—
Exploit Today
10
0-100
Publicado: 19 de out. de 2026 · Última mod.: 22 de out. de 2026 · CWE-1321
0.4%EPSS · 30 dias0.4%
2026-10-202026-11-06
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart.
- github.comhttps://github.com/airjp73/rvf/blob/61172ff01bf1250893108e5c80f35b5ac0388ecb/packages/core/src/native-form-data/flatten.ts
- github.comhttps://github.com/airjp73/rvf/blob/61172ff01bf1250893108e5c80f35b5ac0388ecb/packages/set-get/src/setPath.ts
- github.comhttps://github.com/airjp73/rvf/commit/4a5e118667549ac41f065b4cfa80b995841c3811
- www.vulncheck.comhttps://www.vulncheck.com/advisories/rvf-set-get-before-7.0.4-prototype-pollution-via-setpath-inherited-methods
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1061444.1 MÉD—
——0Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common) in Progress Software Kendo UI for Angular versions prior to 25.1.0 allows a high-privileged attacker who can control a field path processed by the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.23hCVE-2026-1061284.1 MÉD—
——0Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through 9.2.0 allows a high-privileged attacker who can control a field path processed by components such as the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.22hCVE-2026-1061274.1 MÉD—
——0Prototype Pollution in the setter utility (@progress/kendo-react-common) in Progress Software KendoReact versions 3.5.0 through 16.0.0 allows a high-privileged attacker who can control a field path passed to the utility, directly or through components such as the Form, Scheduler, and Gantt, to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.23hCVE-2026-114604—44.4%
——13GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment can bypass strict comparisons against __proto__, constructor, and prototype, then be coerced during property access so a malicious or compromised upstream incremental GraphQL response writes attacker-controlled properties to Object.prototype in the consuming Node.js process. The affected implementation is packages/utils/src/mergeIncrementalResult.ts and is reachable when consumers merge untrusted @defer or @stream transport results. This issue is fixed in version 12.0.2.2dCVE-2026-1221313.7 BAI26.2%
——8Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.2dCVE-2026-1157626.1 MÉD6.0%
——2draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype objects, and the decoder can then assign attacker-controlled attributes to those objects. Importing a malicious GraphML file can trigger client-side prototype pollution. In the advisory-supported cross-site scripting chain, the editor is opened in Trello mode and the user invokes the Trello integration after the import, allowing the polluted state to execute script in the draw.io origin; an existing Trello connection is not required. This vulnerability is fixed in 31.1.5.3d