Threats tagged 'brew-livereload-cve-2026-35536'

A vulnerability in Livereload's Tornado component prior to version 2.7.1_1 allows incomplete validation of cookie attributes in the set_cookie method. Specifically, the domain, path, and samesite arguments were not fully validated, permitting semicolons that could enable injection of attacker-controlled cookie attributes. This flaw is fixed in version 2.7.1_1.