Log in Start free

Vulnerability · Published Jun 10, 2026 · Assigned by GitHub_M

CVE-2026-46625JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

High 7.5

In plain English

A high-severity prototype pollution in js-cookie from js-cookie. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.9%top 39.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-js-cookieno fix listedDEBIAN-CVE-2026-46625
Debian:13node-js-cookieno fix listedDEBIAN-CVE-2026-46625
Debian:14node-js-cookie3.0.7+~3.0.6-1DEBIAN-CVE-2026-46625
Ubuntu:22.04:LTSnode-js-cookieno fix listedUBUNTU-CVE-2026-46625
Ubuntu:24.04:LTSnode-js-cookieno fix listedUBUNTU-CVE-2026-46625
Ubuntu:25.10node-js-cookieno fix listedUBUNTU-CVE-2026-46625
Ubuntu:26.04:LTSnode-js-cookieno fix listedUBUNTU-CVE-2026-46625
Ubuntu:26.10node-js-cookieno fix listedUBUNTU-CVE-2026-46625
npmjs-cookie3.0.7GHSA-qjx8-664m-686j

Affected products (as reported)

VendorProductVersions
js-cookie js-cookie < 3.0.7

Weakness: CWE-1321, CWE-915 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References