CVE-2026-42874
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Microdot, a minimalistic Python web framework, in versions prior to 2.6.1 does not sanitize string arguments of the Response.set_cookie() method, particularly not detecting the \r\n sequence. This can be a source of header injection attacks. For an attack to be possible, the attacker must first infiltrate the client (e.g., via an independent XSS attack) to send malicious information destined to be stored in a cookie by the server on behalf of the victim.
Risk Assessment
An attacker can perform header injection for an infiltrated client, potentially leading to further attacks. Non-infiltrated clients are safe.
Recommendation
Update Microdot to version 2.6.1 or later. Ensure XSS protection in the application to prevent initial client infiltration.
Related vulnerabilities
- CVE-2026-82418Critical
IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 contain a use-after-free vulnerability that could allow a remote attacker to execute arbitrary code.
- CVE-2026-122013Critical
A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1 in an unknown functionality of /usr/bin/webmgnt within the Multipart Parser component. Manipulating the filename argument results in path traversal, the attack can be initiated remotely, the exploit is public, and the vendor did not respond.
- CVE-2025-71457Critical
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.
- CVE-2026-121933Critical
A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the Setup Wizard component. Manipulating the wizard_router_pwd argument can lead to missing authentication. The attack may be launched remotely, and the exploit has been published and may be used.
- CVE-2026-113373Critical
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account and then receives a new session with the roles of that account.
- CVE-2026-122120Critical
In Yealink Plug-in Softwares before 2.35.219.0, an unauthorized file write vulnerability exists under specific scenarios. It may be exploited by attackers to achieve remote code execution.
- CVE-2026-121932Critical
In Linksys E5350 1.0.00.037, the system function in /wizard/apply.cgi mishandles the ping_ip/traceroute_ip argument, resulting in OS command injection. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-121931Critical
In Linksys WRT54GL 4.30.18, the system function in apply.cgi (Traceroute Diagnostic component) mishandles the traceroute_ip argument, enabling OS command injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-121930Critical
In Linksys WRT54GL 4.30.18, the system function in apply.cgi (Ping Diagnostic component) mishandles the ping_ip argument, causing OS command injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-113780Critical
In ESP-IDF (Espressif IoT Development Framework) from 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary.
Original NVD description (English source)
Microdot is a minimalistic Python web framework. Prior to 2.6.1, the Response.set_cookie() method does not sanitize its string arguments, and in particular will not detect the presence of the \r\n sequence in them. This can be a potential source of header injection attacks. For a header injection attack through this issue to be possible, an attacker must first infiltrate the client (for example through an independent XSS attack), so that it can send malicious information that is destined to be stored in a cookie by the server on behalf of the victim. An attacker that infiltrates one client can only orchestrate a header injection attack for that client, all other clients that were not infiltrated are safe. This vulnerability is fixed in 2.6.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS