JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-     cookie's internal assign() helper copies properties with for...in + plain assignment. When the source     object is produced by JSON.parse, the JSON object's __proto__ member is an own enumerable property, so     the forin enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__     setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is     untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming     set() function then enumerates the merged object with another for...in, every key the attacker placed on     the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set     domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were     locked down. This issue has been patched in version 3.0.7. (CVE-2026-46625)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-
    cookie's internal assign() helper copies properties with for...in + plain assignment. When the source
    object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so
    the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__
    setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is
    untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming
    set() function then enumerates the merged object with another for...in, every key the attacker placed on
    the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set
    domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were
    locked down. This issue has been patched in version 3.0.7. (CVE-2026-46625)

ID	Name	Product	Family	Severity
320817	Linux Distros Unpatched Vulnerability : CVE-2026-46625	Nessus	Misc.	high
442311	SCA: security update for js-cookie (GHSA-qjx8-664m-686j)	Tenable Cloud Security	SCA Checks	high
442311	SCA: security update for js-cookie (GHSA-qjx8-664m-686j)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-46625

high

Tenable Plugins

high

high

high