Prototype pollution in JavaScript Cookie - CVE-2026-46625

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU139385

Prototype pollution in JavaScript Cookie - CVE-2026-46625

Published: July 26, 2026


Vulnerability identifier: #VU139385
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-46625
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to inject cookie attributes.

The vulnerability exists due to improperly controlled modification of object prototype attributes in the assign() helper when processing a JSON-derived attributes object. A remote attacker can supply a specially crafted object containing a __proto__ property to inject cookie attributes.

This issue affects applications that pass attacker-influenced JSON-derived objects as the attributes argument to Cookies.set, Cookies.remove, Cookies.withAttributes, or Cookies.withConverter.


Affected software

JavaScript Cookie
Crowd Data Center
Confluence Data Center
Bitbucket Data Center
Jira Service Management Data Center
Bamboo Data Center
Jira Software Data Center

How to mitigate CVE-2026-46625

Install security update from vendor's website.

JavaScript Cookie - update to 3.0.7
Crowd Data Center - update to 7.2.2
Confluence Data Center - addressed in versions 9.2.22, 10.2.14
Bitbucket Data Center - addressed in versions 9.4.22, 10.2.5, 10.3.2
Jira Service Management Data Center - addressed in versions 10.3.23, 11.3.10
Bamboo Data Center - addressed in versions 10.2.22, 12.1.9
Jira Software Data Center - addressed in versions 10.3.23, 11.3.8

External References

Related Security Bulletins