@effect/platform CVE-2026-115779

Exploitation requires the calling application to pass attacker-controlled/untrusted values into the name, domain, or path arguments of @effect/platform's makeCookie(); applications that set these fields from application constants (the vendor-recommended workaround) are not affected. The injected semicolon lets an attacker append arbitrary cookie attributes - notably a broader Domain to widen scope, or SameSite=None or Max-Age, with the latter two only taking effect when the caller has not itself set those options. Limiting factors: the cookie value field is safe because it passes through encodeURIComponent (which encodes ';'), and CR/LF are rejected by the existing regex so HTTP header splitting is not possible - impact is confined to cookie attribute injection/scope widening. Affected: @effect/platform >=0.1.0 <0.97.1 and effect >=4.0.0-beta.0 <4.0.0-beta.103.

This is a medium-severity cookie attribute injection flaw (CWE-74), consistently rated CVSS 4.0 6.3 by the reporter, and my independent assessment agrees. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VC:L/VI:L, SC:L/SI:L) is internally coherent: it is network-reachable and needs no authentication or user interaction, but AT:P correctly flags that exploitation depends on a precondition outside the attacker's control - namely that the application wires untrusted input into makeCookie()'s name, domain, or path fields. There is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of active or widespread exploitation. A public PoC reference exists - the GHSA advisory supplies a concrete worked payload ('legit.com; Domain=.parent.tld') and the patch PRs add test cases exercising the injection - but it is not verified as working standalone exploit code. The vuln.today decision label is 'this_month', not act_now/emergency, which aligns with the signals: a real but bounded issue warranting scheduled patching rather than crisis response. Net assessment: a genuine issue to fix this month, not a high-urgency emergency; the impact is limited to cookie scope widening / attribute addition (no header splitting, no RCE), and real-world exposure is gated on a non-default coding pattern.

An application using @effect/platform builds a Set-Cookie header via makeCookie() and derives the cookie's domain, path, or name from untrusted input (e.g., a tenant/subdomain value from the request). An attacker submits a domain such as 'legit.com; Domain=.parent.tld', which serializeCookie() writes verbatim, so RFC 6265 §5.3 honors the last Domain and widens the cookie to the parent domain - exposing it to sibling subdomains, or silently adding SameSite=None/Max-Age when the caller did not set them. A public PoC-style worked example is published in the GHSA advisory, but no verified standalone exploit tool is cited.