Description
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
Recommendation
Update the tough-cookie package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.1.3
- Patched version(s): 4.1.3
References
- GHSA-72xf-g2v4-qvf3
- security.snyk.io
- lists.debian.org
- lists.fedoraproject.org
- security.netapp.com
- CVE-2023-26136
- CWE-1321
- CAPEC-310
- OWASP 2021-A6
Related Issues
- protobufjs Prototype Pollution vulnerability - CVE-2023-36665
- plotly.js prototype pollution vulnerability - CVE-2023-46308
- uPlot Prototype Pollution vulnerability - CVE-2024-21489
- Starcounter-Jack JSON-Patch Prototype Pollution vulnerability - CVE-2021-4279
- Tags:
- npm
- tough-cookie
Anything's wrong? Let us know Last updated on June 21, 2024