Effect
Monthly
Cookie attribute injection in the Effect TypeScript framework's makeCookie() lets an application that feeds untrusted strings into the cookie name, domain, or path fields serialize extra attributes into Set-Cookie headers. Affected releases are @effect/platform from 0.1.0 up to but excluding 0.97.1, and effect from 4.0.0-beta.0 up to but excluding 4.0.0-beta.103; a crafted domain such as "legit.com; Domain=.parent.tld" widens the cookie to a parent domain because RFC 6265 takes the last Domain occurrence, and SameSite=None or Max-Age can be appended but only when the caller has not set those options itself. No public exploit was identified at time of analysis, and vendor fixes ship in @effect/platform 0.97.1 and effect 4.0.0-beta.103.
effect through 1.0.4 is vulnerable to Command Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cookie attribute injection in the Effect TypeScript framework's makeCookie() lets an application that feeds untrusted strings into the cookie name, domain, or path fields serialize extra attributes into Set-Cookie headers. Affected releases are @effect/platform from 0.1.0 up to but excluding 0.97.1, and effect from 4.0.0-beta.0 up to but excluding 4.0.0-beta.103; a crafted domain such as "legit.com; Domain=.parent.tld" widens the cookie to a parent domain because RFC 6265 takes the last Domain occurrence, and SameSite=None or Max-Age can be appended but only when the caller has not set those options itself. No public exploit was identified at time of analysis, and vendor fixes ship in @effect/platform 0.97.1 and effect 4.0.0-beta.103.
effect through 1.0.4 is vulnerable to Command Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.