CVE-2026-6019
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The http.cookies.Morsel.js_output() function returns an inline <script> snippet and does not neutralize the </script> sequence, allowing HTML injection. Mitigation base64-encodes the cookie value.
Risk Assessment
An attacker can inject malicious script, leading to XSS attacks.
Recommendation
Apply mitigation by base64-encoding the cookie value or update the library.
Other vulnerabilities in Python http.cookies
See all- CVE-2026-0672Medium
In http.cookies.Morsel (Python), user-controlled cookie values and parameters can allow injecting HTTP headers into messages. The patch rejects all control characters within cookie names, values, and parameters.
- CVE-2026-3644High
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
Original NVD description (English source)
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS