CVE-2026-6019

MediumCVSS 6.1

Published: 22/04/2026(UTC)Updated: 27/07/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The http.cookies.Morsel.js_output() function returns an inline <script> snippet and does not neutralize the </script> sequence, allowing HTML injection. Mitigation base64-encodes the cookie value.

Risk Assessment

An attacker can inject malicious script, leading to XSS attacks.

Recommendation

Apply mitigation by base64-encoding the cookie value or update the library.

Original NVD description (English source)

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.