AIKIDO-2025-10321
spree_core is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag
50
Medium Risk
This Affects:
spree_coreTL;DR
Affected versions of the package may expose sensitive cookie information due to the absence of the HttpOnly flag in the create_token_cookie function. Without this flag, compatible browsers may allow client-side scripts to access the cookie, increasing the risk of data exfiltration in the event of a cross-site scripting (XSS) attack. Setting the HttpOnly attribute in the Set-Cookie HTTP response header instructs supporting browsers to restrict cookie access from JavaScript, thereby mitigating the risk of client-side attacks attempting to read and leak sensitive authentication tokens or session data.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
spree_core is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag in versions 5.0.0 - 5.0.3.
How to fix this
Upgrade the spree_core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.