CVE-2026-6019: BaseCookie.js_output() does not neutralize embedded characters
BaseCookie.jsoutput() does not neutralize embedded characters
Other sources
http.cookies.Morsel.jsoutput() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u5Fixed in 3.13.15-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.7-3Fixed in 3.14.7-4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6019?
CVE-2026-6019 is classified as a high-severity vulnerability due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2026-6019?
To mitigate CVE-2026-6019, ensure that your implementation of the http.cookies.Morsel module properly neutralizes sensitive characters in script outputs.
What software is affected by CVE-2026-6019?
CVE-2026-6019 affects the Python http.cookies.Morsel module.
What type of vulnerability is CVE-2026-6019?
CVE-2026-6019 is a cross-site scripting (XSS) vulnerability due to improper handling of embedded characters in generated script tags.
When was CVE-2026-6019 disclosed?
CVE-2026-6019 was disclosed in 2026, following its identification as a security issue within the Python standard library.