Executive brief
js-cookie is a popular JavaScript library used by web developers to manage browser cookies. A security flaw in how the library handles data allows an attacker to manipulate cookie attributes like security flags, expiration dates, and the domains where the cookies are valid. This could allow an attacker to weaken a website's security by disabling 'Secure' flags or redirecting sensitive session information to a domain they control.
Technical details
A prototype pollution vulnerability exists in js-cookie's internal assign() helper due to the use of a for...in loop and plain assignment when merging objects. When an application passes a JSON-parsed object (containing a "__proto__" key) as an attributes argument to functions like Cookies.set() or Cookies.remove(), the assign() helper triggers the Object.prototype.__proto__ setter on the target object. This results in a per-instance prototype hijack where the merged attributes object inherits attacker-controlled properties. Consequently, these injected properties are included in the final Set-Cookie string, allowing attackers to override critical security attributes (e.g., setting secure=false or changing the domain). The issue is fixed in version 3.0.7 by explicitly skipping the "__proto__" key during assignment.
Affected products
- js-cookie js-cookie < 3.0.7
Timeline
- 2026-05-16: patched: Version 3.0.7 released to address the vulnerability.
- 2026-06-10: disclosed: CVE-2026-46625 published.