CVE-2026-46625

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 7.5EPSS <1%

Published 2026-06-10Updated 2026-06-10

Media 609

Vulnerability details

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CNAGitHub_M

EPSS score history

Sources

5 links

PoC links are not available for guest users. Login to view them.

CVEShield GitHub Security Advisories CVE Organization RedHat Vuln DB NVD Analysis

Profile

CVSS

7.5

EPSS

<1%

Published

2026-06-10

Updated

2026-06-10

CNA

GitHub_M

Vendors

No vendors listed.

CPEs

cpe:/a:redhat:service_mesh:3.3::el9

cpe:/a:redhat:cryostat:4

cpe:/a:redhat:openshift_lightspeed

cpe:/a:redhat:red_hat_3scale_amp:2

cpe:/a:redhat:advanced_cluster_security:4

cpe:/a:redhat:rhdh:1

cpe:/a:redhat:jboss_enterprise_application_platform:7

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:jboss_enterprise_application_platform:8

cpe:/a:redhat:jbosseapxp

cpe:/a:redhat:ansible_automation_platform:2

cpe:/a:redhat:discovery:2::el9

cpe:/o:redhat:enterprise_linux:10

cpe:/o:redhat:enterprise_linux:8

cpe:/o:redhat:enterprise_linux:9

cpe:/a:redhat:openshift:4

cpe:/a:redhat:ansible_portal:2

cpe:/a:redhat:advanced_cluster_security:4.10::el8

cpe:/a:redhat:cryostat:4::el9

cpe:/a:redhat:rhdh:1.10::el9

cpe:/a:redhat:rhdh:1.9::el9

cpe:/a:redhat:ansible_portal:2.1

cpe:/a:redhat:ansible_portal:2.2

cpe:/a:redhat:ansible_automation_platform:2.7::el9

cpe:/a:redhat:openshift_ai:3.4::el9

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated