CVE-2026-46625

A flaw was found in JavaScript Cookie (js-cookie). This vulnerability allows a remote attacker to manipulate cookie attributes by exploiting a prototype pollution issue within the assign() helper function. When processing specially crafted JSON input, the flaw enables an attacker to hijack the prototype of a cookie's attribute object. This allows the attacker to set sensitive cookie attributes such as domain, secure, samesite, expires, and path, potentially leading to security bypasses or session manipulation.

Important: This flaw in the js-cookie JavaScript library allows for cookie attribute manipulation via prototype pollution. When applications process untrusted JSON data with affected versions of js-cookie, an attacker could control sensitive cookie properties such as domain or secure, potentially leading to session fixation or other client-side security bypasses.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.