Hi,

The banner script served from cdn.cookie-script.com (for example https://cdn.cookie-script.com/s/8bb4761802007ecb0fbe7aba0f7663b9.js) bundles js-cookie v3.0.0-rc.0.

This version is affected by CVE-2026-46625 (GHSA-qjx8-664m-686j, severity High). It is a prototype pollution issue in the internal assign() helper that allows cookie-attribute injection. The issue is fixed in js-cookie 3.0.7.

We reviewed the current script. The cookie attributes are built inside your code, not from external input, so we don’t think the issue is exploitable today. However, security scanners report it as High on every site that uses the banner.

Could you please evaluate upgrading the bundled js-cookie to 3.0.7 or later? A short note on the expected timeline would also be helpful.

thanks in advance.