GHSA-8hq9-phh3-p2wp
Elysia Cookie Value Prototype Pollution
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Elysia cookie can be overridden by prototype pollution , eg. `__proto__`
Sending cookie with the follows name can override cookie value:
```bash
__proto__=%7B%22injected%22%3A%22polluted%22%7D
```
### Patches
Patched by 1.4.27
### Workarounds
1. Use t.Cookie validation to enforce validation value
2. Prevent iterable over cookie if possible
References
External links from the advisory. They lead to third-party sites.