The vulnerability in airjp73 rvf (formerly Remix Validated Form) is due to improper filtering in the setPath function of the @rvf/set-get package, which is used to flatten incoming form data into nested objects. Specifically, keys such as __proto__, constructor, and prototype are not blocked during path traversal, enabling prototype pollution. Since form field names are passed directly to setPath via preprocessFormData and related functions, an attacker submitting crafted form data can inject arbitrary properties into Object.prototype of the running server process. This affects any endpoint accepting form data via parseFormData or using validators created with createValidator. The issue affects versions >=6.0.0 and <6.0.4, and >=7.0.0 and <7.0.2, and is resolved in versions 6.0.4 and 7.0.2.

Successful exploitation allows an attacker to modify Object.prototype properties on the server process, which can lead to server-side application logic manipulation or other unintended behavior. The CVSS score of 8.2 (high severity) reflects the network attack vector, low attack complexity, no privileges or user interaction required, and impact on integrity and availability. There is no indication of confidentiality impact. No known exploits in the wild have been reported at this time.

This vulnerability is fixed in airjp73 rvf versions 6.0.4 and 7.0.2. Users should upgrade to these or later versions to remediate the issue. Since no official patch links or advisories are provided, verify the upgrade through the vendor's official release channels. Until upgraded, avoid accepting untrusted form data through affected endpoints or implement custom validation to block prototype pollution keys. Patch status is not explicitly confirmed in the advisory, so check vendor sources for the latest remediation guidance.