CVE-2026-6019

BaseCookie.js_output() does not neutralize embedded characters

Published: 4/22/2026 Last updated: 4/29/2026 Reserved: 4/9/2026

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

CNA assigner: PSF (28c92f92-d60d-412d-b760-e73465c3df22) Requested by: n/a

Metrics

Version	Score	Severity	Vector String
4.0	2.1	Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Opam packages affected (7)

conf-python-2-7 conf-python-2-7-dev conf-python-3 conf-python-3-7 conf-python-3-dev py termbox

Products affected (2)

Product	Vendor	Version
CPython	Python Software Foundation	n/a
CPython	Python Software Foundation	6.3.0

References (12)

Credits (4)

2 oolongeya (https://github.com/komi22)
4 Seth Larson (https://github.com/sethmlarson)
2 oolongeya (https://github.com/komi22)
4 Seth Larson (https://github.com/sethmlarson)