CVE-2026-46625

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookies internal assign() helper copies properties with for…in + plain assignment. When the source object is produced by JSON.parse, the JSON objects proto member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.proto setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for…in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.

Weakness

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Affected Software

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/1.html
• https://cwe.mitre.org/data/definitions/180.html
• https://cwe.mitre.org/data/definitions/77.html

References

• https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020
• https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7
• https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j
• https://access.redhat.com/errata/RHSA-2026:33183
• https://access.redhat.com/security/cve/CVE-2026-46625
• https://bugzilla.redhat.com/show_bug.cgi?id=2487740
• https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46625.json