Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

Summary The forge.http client stored cookies from Set-Cookie response headers in a plain object keyed by cookie name and path. A malicious server could use the cookie name proto to add properties to Object.prototype, use inherited names such as constructor to add properties to Object, and send an...

GHSA-6WVX-3R32-XMCG Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

Summary The forge.http client stored cookies from Set-Cookie response headers in a plain object keyed by cookie name and path. A malicious server could use the cookie name proto to add properties to Object.prototype, use inherited names such as constructor to add properties to Object, and send an...