{"action":"Upgrade js-cookie to 3.0.7 or later.","affected":[{"fixed":"3.0.7","introduced":"0"}],"component":"js-cookie","cve_ids":["CVE-2026-46625"],"ecosystem":"npm","epss":0.00919,"exploited":false,"fixed_versions":["3.0.7"],"ghsa_id":"GHSA-qjx8-664m-686j","id":"tcs_01M5KG6EJSQNQJ47HY1Z9WFGJD","modified_at":"2026-09-10T03:50:47.374021767Z","published_at":"2026-05-21T21:20:31Z","references":["https://osv.dev/vulnerability/GHSA-qjx8-664m-686j","https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j","https://nvd.nist.gov/vuln/detail/CVE-2026-46625","https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020","https://github.com/js-cookie/js-cookie","https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-qjx8-664m-686j","url":"https://osv.dev/vulnerability/GHSA-qjx8-664m-686j"}],"summary":"JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection"}