AIKIDO-2026-527558

TL;DR

Plug.Conn.Cookies.encode/2 in the Elixir plug library builds the Set-Cookie response header by interpolating the cookie path, domain and same_site attributes directly into the header string without validating the ; character. Any Plug application that reflects attacker-controlled data into a cookie attribute lets an unauthenticated attacker inject additional cookie attributes through ;. Plug already handles and null bytes accordingly, so header injection is not possible.