{"id":"CVE-2026-46625","title":"JavaScript Cookie is a JavaScript API for handling cookies, client-side","summary":"JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, t…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-1321","CWE-915"],"vendor":"js-cookie","product":"javascript_cookie","affected":["javascript_cookie < 3.0.7","3scale_api_management = 2.0","ansible_automation_platform = 2.0","openshift_ai","openshift_lightspeed","enterprise_linux = 8.0","enterprise_linux = 9.0","enterprise_linux = 10.0"],"patched":["javascript_cookie 3.0.7"],"published":"2026-06-10","updated":"2026-09-09","sourceUpdated":"2026-09-09T13:20:18.357","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46625","references":[{"url":"https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020","label":"security-advisories@github.com"},{"url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7","label":"security-advisories@github.com"},{"url":"https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:33183","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36625","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48126","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48151","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:49642","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:52768","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:56338","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:56357","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59153","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-46625","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487740","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46625.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46625"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46625"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-06-11T14:46:15.083511Z"},"epss":0.00919,"epssPercentile":0.60079,"ingestedAt":"2026-08-29T00:27:53.248Z","slug":"CVE-2026-46625","body":"## Overview\n\nJavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's \"__proto__\" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.\n\n## Affected\n\n- `javascript_cookie < 3.0.7`\n- `3scale_api_management = 2.0`\n- `ansible_automation_platform = 2.0`\n- `openshift_ai`\n- `openshift_lightspeed`\n- `enterprise_linux = 8.0`\n- `enterprise_linux = 9.0`\n- `enterprise_linux = 10.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `javascript_cookie 3.0.7`\n\n## Vendor advisories\n\n- **RHSA-2026:48151** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48151)\n- **RHSA-2026:36625** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.10 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36625)\n- **RHSA-2026:56338** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56338)\n- **RHSA-2026:56357** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56357)\n- **RHSA-2026:59153** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59153)\n- **RHSA-2026:48126** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48126)\n- **RHSA-2026:49642** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49642)\n- **RHSA-2026:52768** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52768)\n- **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520)\n- **RHSA-2026:33183** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.3 · released 2026-06-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:33183)\n- **Red Hat VEX** · Important · affected: OpenShift Lightspeed, Red Hat 3scale API Management Platform 2, Red Hat Ansible Automation Platform 2, Red Hat JBoss Enterprise Application Platform 7 · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat JBoss Enterprise Application Platform 7, OpenShift Lightspeed, Red Hat 3scale API Management Platform 2 · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46625.json)\n- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":201697,"id":"CVE-2026-46625","ts":1789399607164,"field":"exploit_available","old":"false","new":"true"},{"seq":200429,"id":"CVE-2026-46625","ts":1789397238159,"field":"exploit_available","old":"true","new":"false"},{"seq":198353,"id":"CVE-2026-46625","ts":1789391859031,"field":"exploit_available","old":"false","new":"true"},{"seq":196144,"id":"CVE-2026-46625","ts":1789383510215,"field":"exploit_available","old":"true","new":"false"},{"seq":195073,"id":"CVE-2026-46625","ts":1789380376328,"field":"exploit_available","old":"false","new":"true"},{"seq":193860,"id":"CVE-2026-46625","ts":1789378358731,"field":"exploit_available","old":"true","new":"false"},{"seq":192647,"id":"CVE-2026-46625","ts":1789376326483,"field":"exploit_available","old":"false","new":"true"},{"seq":191434,"id":"CVE-2026-46625","ts":1789373268066,"field":"exploit_available","old":"true","new":"false"},{"seq":190219,"id":"CVE-2026-46625","ts":1789369204962,"field":"exploit_available","old":"false","new":"true"},{"seq":189006,"id":"CVE-2026-46625","ts":1789368134739,"field":"exploit_available","old":"true","new":"false"},{"seq":187789,"id":"CVE-2026-46625","ts":1789365066062,"field":"exploit_available","old":"false","new":"true"},{"seq":186576,"id":"CVE-2026-46625","ts":1789363103719,"field":"exploit_available","old":"true","new":"false"},{"seq":185362,"id":"CVE-2026-46625","ts":1789361028733,"field":"exploit_available","old":"false","new":"true"},{"seq":184149,"id":"CVE-2026-46625","ts":1789358034991,"field":"exploit_available","old":"true","new":"false"},{"seq":182400,"id":"CVE-2026-46625","ts":1789354158405,"field":"exploit_available","old":"false","new":"true"},{"seq":181193,"id":"CVE-2026-46625","ts":1789353003899,"field":"exploit_available","old":"true","new":"false"},{"seq":179986,"id":"CVE-2026-46625","ts":1789350083689,"field":"exploit_available","old":"false","new":"true"},{"seq":178779,"id":"CVE-2026-46625","ts":1789347953544,"field":"exploit_available","old":"true","new":"false"},{"seq":177572,"id":"CVE-2026-46625","ts":1789346221163,"field":"exploit_available","old":"false","new":"true"},{"seq":176365,"id":"CVE-2026-46625","ts":1789342871590,"field":"exploit_available","old":"true","new":"false"},{"seq":175819,"id":"CVE-2026-46625","ts":1789338654821,"field":"exploit_available","old":"false","new":"true"},{"seq":175689,"id":"CVE-2026-46625","ts":1789338474502,"field":"exploit_available","old":"true","new":"false"},{"seq":174484,"id":"CVE-2026-46625","ts":1789334664127,"field":"exploit_available","old":"false","new":"true"},{"seq":173279,"id":"CVE-2026-46625","ts":1789333342889,"field":"exploit_available","old":"true","new":"false"},{"seq":172093,"id":"CVE-2026-46625","ts":1789330944194,"field":"exploit_available","old":"false","new":"true"},{"seq":170907,"id":"CVE-2026-46625","ts":1789328477347,"field":"exploit_available","old":"true","new":"false"},{"seq":169702,"id":"CVE-2026-46625","ts":1789326981839,"field":"exploit_available","old":"false","new":"true"},{"seq":168497,"id":"CVE-2026-46625","ts":1789323542820,"field":"exploit_available","old":"true","new":"false"},{"seq":167292,"id":"CVE-2026-46625","ts":1789319434151,"field":"exploit_available","old":"false","new":"true"},{"seq":166087,"id":"CVE-2026-46625","ts":1789318423598,"field":"exploit_available","old":"true","new":"false"},{"seq":164882,"id":"CVE-2026-46625","ts":1789315617283,"field":"exploit_available","old":"false","new":"true"},{"seq":163677,"id":"CVE-2026-46625","ts":1789313359040,"field":"exploit_available","old":"true","new":"false"},{"seq":162472,"id":"CVE-2026-46625","ts":1789311756118,"field":"exploit_available","old":"false","new":"true"},{"seq":161267,"id":"CVE-2026-46625","ts":1789308384755,"field":"exploit_available","old":"true","new":"false"},{"seq":160772,"id":"CVE-2026-46625","ts":1789304316663,"field":"exploit_available","old":"false","new":"true"},{"seq":160319,"id":"CVE-2026-46625","ts":1789303874579,"field":"exploit_available","old":"true","new":"false"},{"seq":159380,"id":"CVE-2026-46625","ts":1789300333315,"field":"exploit_available","old":"false","new":"true"},{"seq":158610,"id":"CVE-2026-46625","ts":1789299375231,"field":"exploit_available","old":"true","new":"false"},{"seq":157574,"id":"CVE-2026-46625","ts":1789296517199,"field":"exploit_available","old":"false","new":"true"},{"seq":156369,"id":"CVE-2026-46625","ts":1789294471825,"field":"exploit_available","old":"true","new":"false"},{"seq":155164,"id":"CVE-2026-46625","ts":1789292722443,"field":"exploit_available","old":"false","new":"true"},{"seq":153959,"id":"CVE-2026-46625","ts":1789289445747,"field":"exploit_available","old":"true","new":"false"},{"seq":152609,"id":"CVE-2026-46625","ts":1789281351310,"field":"exploit_available","old":"false","new":"true"},{"seq":152249,"id":"CVE-2026-46625","ts":1789280967161,"field":"exploit_available","old":"true","new":"false"},{"seq":151210,"id":"CVE-2026-46625","ts":1789277468650,"field":"exploit_available","old":"false","new":"true"},{"seq":150171,"id":"CVE-2026-46625","ts":1789275925021,"field":"exploit_available","old":"true","new":"false"},{"seq":149138,"id":"CVE-2026-46625","ts":1789273634162,"field":"exploit_available","old":"false","new":"true"},{"seq":148105,"id":"CVE-2026-46625","ts":1789270981173,"field":"exploit_available","old":"true","new":"false"},{"seq":146145,"id":"CVE-2026-46625","ts":1789269220174,"field":"exploit_available","old":"false","new":"true"},{"seq":145047,"id":"CVE-2026-46625","ts":1789266190700,"field":"exploit_available","old":"true","new":"false"}]}