cve/2023/CVE-2023-26136.md

CVE-2023-26136

Description

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

POC

Reference

• https://github.com/salesforce/tough-cookie/issues/282
• https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873

Github

• https://github.com/CUCUMBERanOrSNCompany/SealSecurityAssignment
• https://github.com/fkie-cad/nvd-json-data-feeds
• https://github.com/mathworks/MATLAB-language-server
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/seal-community/patches
• https://github.com/trong0dn/eth-todo-list