CVE-2026-46625
published 2026-06-10CVE-2026-46625: JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.99%
62.0th percentile
JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel9 | — | — |
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| discovery | discovery-ui-rhel9 | — | — |
| grafana | grafana | — | — |
| js-cookie | javascript_cookie | < 3.0.7 | 3.0.7 |
| js-cookie | js-cookie | < 3.0.7 | 3.0.7 |
| js-cookie | js-cookie | — | — |
| openshift-lightspeed | lightspeed-console-plugin-419-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-rhel9 | — | — |
| openshift-service-mesh | kiali-ossmc-rhel9_1782231869 | — | — |
| openshift-service-mesh | kiali-rhel9_1782201466 | — | — |
| openshift4 | ose-agent-installer-ui-rhel9 | — | — |
| redhat | 3scale_api_management | — | — |
| redhat | ansible_automation_platform | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| rhdh | rhdh-hub-rhel9 | — | — |
| rhoai | odh-dashboard-rhel9 | — | — |
| rhoai | odh-mod-arch-automl-rhel9 | — | — |
| rhoai | odh-mod-arch-autorag-rhel9 | — | — |
| rhoai | odh-mod-arch-eval-hub-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution
vendor_redhat·2026-06-10·CVSS 7.5
CVE-2026-46625 [HIGH] CWE-915 js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution
js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution
JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attac
GHSA
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
ghsa·2026-05-21
CVE-2026-46625 [HIGH] CWE-1321 JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
## Summary
`js-cookie`'s internal `assign()` helper copies properties with `for...in` + plain assignment. When the source object is produced by `JSON.parse`, the JSON object's `"__proto__"` member is an *own enumerable* property, so the `for…in` enumerates it and the `target[key] = source[key]` write triggers the **`Object.prototype.__proto__` setter** on the fresh `target` (`{}`). The result is a per-instance prototype hijack: `Object.prototype` itself is untouched, but the merged `attributes` object now inherits attacker-controlled keys.
Because the consuming `set()` function then enumerates the merged object with another `for...in`, every key the attacker placed on the polluted prototype l
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-46625 phpMyAdmin: JavaScript Cookie: Cookie attribute manipulation via prototype pollution [fedora-all]
bugzilla·2026-08-05·CVSS 7.5
CVE-2026-46625 [HIGH] CVE-2026-46625 phpMyAdmin: JavaScript Cookie: Cookie attribute manipulation via prototype pollution [fedora-all]
CVE-2026-46625 phpMyAdmin: JavaScript Cookie: Cookie attribute manipulation via prototype pollution [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a
Bugzilla
CVE-2026-46625 phpMyAdmin: JavaScript Cookie: Cookie attribute manipulation via prototype pollution [epel-all]
bugzilla·2026-08-05·CVSS 7.5
CVE-2026-46625 [HIGH] CVE-2026-46625 phpMyAdmin: JavaScript Cookie: Cookie attribute manipulation via prototype pollution [epel-all]
CVE-2026-46625 phpMyAdmin: JavaScript Cookie: Cookie attribute manipulation via prototype pollution [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a pe
Bugzilla
CVE-2026-46625 forgejo: JavaScript Cookie: Cookie attribute manipulation via prototype pollution [fedora-all]
bugzilla·2026-08-05·CVSS 7.5
CVE-2026-46625 [HIGH] CVE-2026-46625 forgejo: JavaScript Cookie: Cookie attribute manipulation via prototype pollution [fedora-all]
CVE-2026-46625 forgejo: JavaScript Cookie: Cookie attribute manipulation via prototype pollution [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per
Bugzilla
CVE-2026-46625 grafana-pcp: JavaScript Cookie: Cookie attribute manipulation via prototype pollution [fedora-all]
bugzilla·2026-08-05·CVSS 7.5
CVE-2026-46625 [HIGH] CVE-2026-46625 grafana-pcp: JavaScript Cookie: Cookie attribute manipulation via prototype pollution [fedora-all]
CVE-2026-46625 grafana-pcp: JavaScript Cookie: Cookie attribute manipulation via prototype pollution [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a
Bugzilla
CVE-2026-46625 forgejo: JavaScript Cookie: Cookie attribute manipulation via prototype pollution [epel-all]
bugzilla·2026-08-05·CVSS 7.5
CVE-2026-46625 [HIGH] CVE-2026-46625 forgejo: JavaScript Cookie: Cookie attribute manipulation via prototype pollution [epel-all]
CVE-2026-46625 forgejo: JavaScript Cookie: Cookie attribute manipulation via prototype pollution [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-i
Bugzilla
CVE-2026-46625 js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution
bugzilla·2026-06-10·CVSS 7.5
CVE-2026-46625 [HIGH] CVE-2026-46625 js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution
CVE-2026-46625 js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution
JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, ever
https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686jhttps://access.redhat.com/errata/RHSA-2026:33183https://access.redhat.com/errata/RHSA-2026:36625https://access.redhat.com/errata/RHSA-2026:48126https://access.redhat.com/errata/RHSA-2026:48151https://access.redhat.com/errata/RHSA-2026:49642https://access.redhat.com/errata/RHSA-2026:52768https://access.redhat.com/errata/RHSA-2026:56338https://access.redhat.com/errata/RHSA-2026:56357https://access.redhat.com/errata/RHSA-2026:59153https://access.redhat.com/errata/RHSA-2026:60520https://access.redhat.com/security/cve/CVE-2026-46625https://bugzilla.redhat.com/show_bug.cgi?id=2487740https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686jhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46625.json
2026-06-10
Published