Back to the CVE list
CVE-2023-26136

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

CVSS score

9.8

EPSS probability

%2.6

Risk score

0.3

Published

3 y ago

OverviewPublic Exploits (2)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
morrisel/CVE-2023-26136
GitHub

This repository contains a solution for the CVE-2023-26136 vulnerability. (★0)

Public PoCSource updated: 10.02.2025 18:54:17
G
uriyahav/tough-cookie-2.5.0-cve-2023-26136-fix
GitHub

ecurity patch for CVE-2023-26136 in tough-cookie 2.5.0 - Prototype pollution vulnerability fix with backward compatibility (★0)

Public PoCSource updated: 18.06.2025 16:37:10

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2023-26136"