RVF (Remix Validated Form) library contains a prototype pollution vulnerability in versions 6.0.0 to before 6.0.4 and 7.0.2. The setPath function in @rvf/set-get does not block dangerous keys like __proto__, constructor, or prototype when processing form data. Attackers can submit forms to exploit this vulnerability and set arbitrary properties on Object.prototype of the server process. The vulnerability is easily exploitable as it requires no special configuration and affects any endpoint using parseFormData or validators created with createValidator. Fixed versions are 6.0.4 and 7.0.2.