StackRadar

CVE-2026-46625

High

Advisory

Published 21 May 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.009
58th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
60
of 17,781 indexed, latest versions
Container images
56
deployed by those charts
Fix available
1 of 1
affected package

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

Carried by container images the latest versions of 60 of 17,781 indexed charts deploy, on 56 images.

Affected packageAffected versionsFixed inImages
js-cookienpm2.2.1, 3.0.1, 3.0.53.0.756
OSV records
GHSA-qjx8-664m-686j

Charts affected

60 by stars
ChartLatestAffected imagesRadar Score
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
js-cookie@2.2.1
3.0.7

Open the chart page →

11,384
redisinsight-secureredisinsight-secureVerified publisher1.0.21 of 1See more

redisinsight-secure redisinsight-secure 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
redis/redisinsight:2.68019fcf774631
js-cookie@3.0.5
3.0.7

Open the chart page →

1,721
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
js-cookie@2.2.1
3.0.7

Open the chart page →

6,168
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
js-cookie@2.2.1
3.0.7

Open the chart page →

10,530
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
js-cookie@3.0.5
3.0.7

Open the chart page →

2,654
codetogethercodetogether1.4.251 of 1See more

codetogether codetogether 1.4.25

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
codetogether/codetogether:latest4348c8a38752
js-cookie@2.2.1
3.0.7

Open the chart page →

7,450
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
js-cookie@3.0.5
3.0.7

Open the chart page →

17,404
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
js-cookie@3.0.5
3.0.7

Open the chart page →

28,839
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
js-cookie@3.0.1
3.0.7

Open the chart page →

7,579
graphql-hivegraphql-hive1.0.01 of 17See more

graphql-hive graphql-hive 1.0.0

1 of the 17 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
js-cookie@2.2.1
3.0.7

Open the chart page →

10,311
flagsmithone-acre-fundVerified publisher0.1.51 of 6See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
flagsmith/flagsmith-frontend:v2.6.0df02a29e8b0c
js-cookie@2.2.1
3.0.7

Open the chart page →

6,868
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
js-cookie@2.2.1
3.0.7

Open the chart page →

17,896
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
js-cookie@2.2.1
3.0.7

Open the chart page →

10,730
opensearch-dashboardscaptnbpVerified publisher2.2.11 of 1See more

opensearch-dashboards captnbp 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
js-cookie@2.2.1
3.0.7

Open the chart page →

1,843
tasmo-admincrystalnetVerified publisher3.0.111 of 1See more

tasmo-admin crystalnet 3.0.11

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
ghcr.io/tasmoadmin/tasmoadmin:v3.3.205aeefbdac2b
js-cookie@3.0.5
3.0.7

Open the chart page →

891
data-fairdata354-helmVerified publisher1.1.25 of 12See more

data-fair data354-helm 1.1.2

5 of the 12 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
js-cookie@3.0.5
3.0.7
ghcr.io/data-fair/metrics:0a8d40779eeae
js-cookie@3.0.1
3.0.7
ghcr.io/data-fair/notify:3c739b74dabb0
js-cookie@3.0.5
3.0.7
ghcr.io/data-fair/processings:15a9216989707
js-cookie@3.0.5
3.0.7
ghcr.io/data-fair/simple-directory:438a4f32fad82
js-cookie@3.0.1
3.0.7

Open the chart page →

38,346
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
js-cookie@2.2.1
3.0.7

Open the chart page →

3,444
elasticinseefrlab2.2.01 of 2See more

elastic inseefrlab 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
library/kibana:7.17.3e2e2031c15be
js-cookie@2.2.1
3.0.7

Open the chart page →

17,284
kenerkenerVerified publisher0.2.01 of 1See more

kener kener 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
js-cookie@3.0.5
3.0.7

Open the chart page →

5,228
kibanaromanow-helm-chartsVerified publisher1.7.11 of 1See more

kibana romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
library/kibana:7.17.8c5781ba340ef
js-cookie@2.2.1
3.0.7

Open the chart page →

6,879
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
js-cookie@3.0.5
3.0.7

Open the chart page →

12,581
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
js-cookie@3.0.5
3.0.7

Open the chart page →

10,090
opendistro-esbeeinventor1.15.11 of 3See more

opendistro-es beeinventor 1.15.1

1 of the 3 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
js-cookie@2.2.1
3.0.7

Open the chart page →

5,806
caninecanine0.1.101 of 7See more

canine canine 0.1.10

1 of the 7 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
ghcr.io/caninehq/canine:latesta058034ca006
js-cookie@3.0.5
3.0.7

Open the chart page →

14,130
coderstudio-strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

coderstudio-strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
js-cookie@2.2.1
3.0.7

Open the chart page →

5,141
docker-composecoderstudio-strapi-devVerified publisher0.0.11 of 3See more

docker-compose coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
js-cookie@2.2.1
3.0.7

Open the chart page →

5,141
strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
js-cookie@2.2.1
3.0.7

Open the chart page →

5,141
conduction-uiconduction-ui0.1.01 of 6See more

conduction-ui conduction-ui 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
conduction/conduction-ui-app:devd591f5e6f2a9
js-cookie@2.2.1
3.0.7

Open the chart page →

12,907
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.4.11787550d2358
js-cookie@2.2.1
3.0.7

Open the chart page →

13,852
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.81 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

1 of the 5 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
library/kibana:7.17.150172f1c538e7
js-cookie@2.2.1
3.0.7

Open the chart page →

34,754
hive-appgraphql-hive1.0.01 of 1See more

hive-app graphql-hive 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
js-cookie@2.2.1
3.0.7

Open the chart page →

2,682
hive-appgraphql-hive-subcharts1.0.01 of 1See more

hive-app graphql-hive-subcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
js-cookie@2.2.1
3.0.7

Open the chart page →

2,682
librechathajowielandVerified publisher1.1.01 of 1See more

librechat hajowieland 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
js-cookie@3.0.5
3.0.7

Open the chart page →

2,950
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
js-cookie@3.0.5
3.0.7

Open the chart page →

6,012
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
js-cookie@3.0.5
3.0.7

Open the chart page →

11,812
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
js-cookie@2.2.1
3.0.7

Open the chart page →

7,232
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
js-cookie@3.0.5
3.0.7

Open the chart page →

3,436
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
js-cookie@3.0.5
3.0.7

Open the chart page →

3,092
kenerkener-chart0.0.71 of 1See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
js-cookie@3.0.5
3.0.7

Open the chart page →

5,228
redisinsightklicktippVerified publisher0.5.01 of 1See more

redisinsight klicktipp 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
redis/redisinsight:3.2.055542a762210
js-cookie@3.0.5
3.0.7

Open the chart page →

1,290
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
js-cookie@3.0.5
3.0.7

Open the chart page →

2,756
redisinsightlogic3579Verified publisher3.4.01 of 1See more

redisinsight logic3579 3.4.0

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
redis/redisinsight:3.485562d67a912
js-cookie@3.0.5
3.0.7

Open the chart page →

1,490
frontendluiscajl0.1.71 of 1See more

frontend luiscajl 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
lavandadelpatio/frontend:latest501c3f31e0bc
js-cookie@2.2.1
3.0.7

Open the chart page →

3,651
mauticmautic-chartVerified publisher1.0.21 of 3See more

mautic mautic-chart 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
mautic/mautic:7-apacheeb8cc73d97e1
js-cookie@2.2.1
3.0.7

Open the chart page →

8,303
aws-api-gateway-operatormintel0.1.21 of 11See more

aws-api-gateway-operator mintel 0.1.2

1 of the 11 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:1.0.039695180364b
js-cookie@2.2.1
3.0.7

Open the chart page →

10,603
standard-application-stackmintel11.4.01 of 12See more

standard-application-stack mintel 11.4.0

1 of the 12 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:1.0.039695180364b
js-cookie@2.2.1
3.0.7

Open the chart page →

10,603
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
js-cookie@2.2.1
3.0.7

Open the chart page →

27,465
flomesh-consoleopenshift0.70.0-30-ubi81 of 2See more

flomesh-console openshift 0.70.0-30-ubi8

1 of the 2 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
js-cookie@2.2.1
3.0.7

Open the chart page →

9,968
codimdphntom0.1.121 of 3See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
phntom/codimd:2.4.31b9aafbb62e6
js-cookie@2.2.1
3.0.7

Open the chart page →

6,524
redisinsightredisinsight-helmVerified publisher0.1.11 of 1See more

redisinsight redisinsight-helm 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-46625.

Container imageDigestPackageFixed in
redis/redisinsight:2.46699d341bd329
js-cookie@3.0.5
3.0.7

Open the chart page →

1,884

Container images carrying it

56 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/sct/overseerr:1.26.1254d16af8f71
js-cookie@2.2.1
3.0.7
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
js-cookie@3.0.5
3.0.7
1
ghcr.io/tasmoadmin/tasmoadmin:v3.3.205aeefbdac2b
js-cookie@3.0.5
3.0.7
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
js-cookie@3.0.5
3.0.7
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
js-cookie@2.2.1
3.0.7
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
js-cookie@3.0.5
3.0.7
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.