Executive brief
A vulnerability in the Elixir Plug library, which handles web requests for many Elixir applications, could allow attackers to manipulate browser cookies. If an application includes user-provided text (like a username) directly in a cookie, an attacker can use special characters to override security settings like 'Secure' or 'HttpOnly' flags. This can lead to session hijacking or other forms of credential theft.
Technical details
The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating cookie values and attributes (path, domain, same_site) directly into the header string without neutralizing the ';' delimiter. If an application reflects attacker-controlled data into a cookie value or attribute via Plug.Conn.put_resp_cookie/4, an attacker can inject a semicolon to append or override attributes. This enables 'cookie tossing' and session fixation by allowing an attacker to drop security flags like Secure and HttpOnly or modify the cookie's scope. While Plug prevents HTTP response splitting by rejecting CRLF and null bytes, it does not prevent this attribute injection. The issue is fixed in versions 1.16.6, 1.17.4, 1.18.5, 1.19.5, and 1.20.3.
Affected products
- elixir-plug plug 0.1.0 to 1.16.5, 1.17.0 to 1.17.3, 1.18.0 to 1.18.4, 1.19.0 to 1.19.4, 1.20.0 to 1.20.2
Timeline
- 2026-07-09: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD