Homepage

Improperly Controlled Modification of Dynamically-Determined Object Attributes The advisory has been revoked - it doesn't affect any version of package grafana-selinux  (opens in a new tab)

Threat Intelligence

EPSS
0.51% (41st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS8-GRAFANASELINUX-17727022
  • published30 Jun 2026
  • disclosed10 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 10 Jun 2026

CVE-2026-46625  (opens in a new tab)
CWE-915  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream grafana-selinux package and not the grafana-selinux package as distributed by Centos.

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "proto" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.proto setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.