Skip to content
Threat Feed

Product

Js-Cookie (<= 3.0.5)

1 brief RSS
high advisory

js-cookie Prototype Pollution via __proto__ Attribute Injection (CVE-2026-46625)

The js-cookie library is vulnerable to prototype pollution via the `assign()` function when processing JSON-derived objects, enabling an attacker to inject arbitrary cookie attributes by manipulating the `__proto__` property, as demonstrated by CVE-2026-46625.

js-cookie prototype-pollution javascript cookie CVE-2026-46625
2r 1t