--- id: CVE-2026-46625 title: 'JavaScript Cookie is a JavaScript API for handling cookies, client-side' summary: >- JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, t… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N' cwe: - CWE-1321 - CWE-915 vendor: js-cookie product: javascript_cookie affected: - javascript_cookie < 3.0.7 - 3scale_api_management = 2.0 - ansible_automation_platform = 2.0 - openshift_ai - openshift_lightspeed - enterprise_linux = 8.0 - enterprise_linux = 9.0 - enterprise_linux = 10.0 patched: - javascript_cookie 3.0.7 published: '2026-06-10' updated: '2026-09-09' sourceUpdated: '2026-09-09T13:20:18.357' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46625' references: - url: >- https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020 label: security-advisories@github.com - url: 'https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7' label: security-advisories@github.com - url: >- https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j label: security-advisories@github.com - url: 'https://access.redhat.com/errata/RHSA-2026:33183' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:36625' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:48126' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:48151' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:49642' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:52768' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:56338' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:56357' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:59153' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60520' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-46625' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2487740' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46625.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-46625' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46625' tags: - nvd - cve.org - exploit-available - csaf - vex - red-hat exploitAvailable: true ssvc: exploitation: poc automatable: 'yes' technicalImpact: partial timestamp: '2026-06-11T14:46:15.083511Z' epss: 0.00986 epssPercentile: 0.60806 ingestedAt: '2026-08-29T00:27:53.248Z' --- ## Overview JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7. ## Affected - `javascript_cookie < 3.0.7` - `3scale_api_management = 2.0` - `ansible_automation_platform = 2.0` - `openshift_ai` - `openshift_lightspeed` - `enterprise_linux = 8.0` - `enterprise_linux = 9.0` - `enterprise_linux = 10.0` ## Remediation Upgrade past the affected range: - `javascript_cookie 3.0.7` ## Vendor advisories - **RHSA-2026:48151** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48151) - **RHSA-2026:36625** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.10 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36625) - **RHSA-2026:56338** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56338) - **RHSA-2026:56357** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56357) - **RHSA-2026:59153** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59153) - **RHSA-2026:48126** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48126) - **RHSA-2026:49642** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49642) - **RHSA-2026:52768** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52768) - **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520) - **RHSA-2026:33183** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.3 · released 2026-06-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:33183) - **Red Hat VEX** · Important · affected: OpenShift Lightspeed, Red Hat 3scale API Management Platform 2, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 8, Red Hat JBoss Enterprise Application Platform 7, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat JBoss Enterprise Application Platform 7, OpenShift Lightspeed, Red Hat 3scale API Management Platform 2, … · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46625.json)