CVE-2026-6019BaseCookie.js_output() does not neutralize embedded characters
Updated under an hour ago ()
Does this affect you?
It affects Python Software Foundation CPython and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
- CVSS
- 2.1 LOW (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-150
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- PSF
- NVD analysis
- Analyzed
- Record last updated
- Jun 10, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Python Software Foundation CPython python_software_foundation:cpython (from the name) | before 3.13.14; from 3.14.0a1 before 3.14.5rc1; from 3.15.0a1 before 3.15.0b1 | CNA record |
python python python:python | before 3.13.14; from 3.14.0 through 3.14.4; 3.15.0; 3.15.0; 3.15.0; 3.15.0; 3.15.0; 3.15.0; and 2 more ranges | NVD |
References
- https://github.com/python/cpython/pull/148848patch, issue-tracking
- https://github.com/python/cpython/issues/90309issue-tracking, exploit
- https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/vendor-advisory, mailing-list
- https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104patch
- https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76cpatch
- https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.