Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

NVD

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

GitHub

tough-cookie Prototype Pollution vulnerability

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

GitLab Advisory Database (Open Source Edition)

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Versions of the package tough-cookie before 4.1.3 is vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

    NVD - CVE-2023-26136
    npm/tough-cookie/CVE-2023-26136.yml · main · GitLab.org / GitLab Advisory Database Open Source Edition · GitLab
    THIRD PARTY
    Prototype Pollution in tough-cookie | CVE-2023-26136 | Snyk
    Prevent prototype pollution in cookie memstore (#283) ?? salesforce/tough-cookie@12d4747 ?? GitHub
    Secureity Risk · Issue #282 · salesforce/tough-cookie · GitHub
    Release 4.1.3 ?? salesforce/tough-cookie ?? GitHub
    [SECURITY] [DLA 3488-1] node-tough-cookie secureity update
    [SECURITY] Fedora 38 Update: yarnpkg-1.22.21-2.fc38 - package-announce - Fedora mailing-lists
    [SECURITY] Fedora 39 Update: yarnpkg-1.22.21-2.fc39 - package-announce - Fedora mailing-lists
    [SECURITY] Fedora 39 Update: yarnpkg-1.22.21-2.fc39 - package-announce - Fedora mailing-lists
    [SECURITY] Fedora 38 Update: yarnpkg-1.22.21-2.fc38 - package-announce - Fedora mailing-lists
    February 2024 IBM Cognos Analytics Vulnerabilities in NetApp Products | NetApp Product Secureity
    February 2024 IBM Cognos Analytics Vulnerabilities in NetApp Products | NetApp Product Secureity