Log in Start free

Vulnerability · Published Jul 1, 2023 · Assigned by snyk

CVE-2023-26136

Medium 6.5

In plain English

A medium-severity prototype pollution in tough-cookie. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)2.6%top 14.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-tough-cookie4.0.0-2+deb12u1DEBIAN-CVE-2023-26136
Debian:13node-tough-cookie4.1.3+~4.0.2-1DEBIAN-CVE-2023-26136
Debian:14node-tough-cookie4.1.3+~4.0.2-1DEBIAN-CVE-2023-26136
Ubuntu:22.04:LTSnode-tough-cookieno fix listedUBUNTU-CVE-2023-26136
Ubuntu:24.04:LTSnode-tough-cookieno fix listedUBUNTU-CVE-2023-26136
npmtough-cookie4.1.3GHSA-72xf-g2v4-qvf3

Affected products (as reported)

VendorProductVersions
n/a tough-cookie 0 – before 4.1.3

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P

References