CVE-2026-6019: BaseCookie.js_output() does not neutralize embedded characters
http.cookies.Morsel.jsoutput() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u2Fixed in 3.13.14-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.6-1 - Configuration
Mitigation: base64-encode the cookie value so embedded characters (e.g., HTML parser-sensitive sequences like </script>) cannot be used to escape the generated <script> element.
http.cookies.Morsel.js_output() output escaping = base64-encode cookie value
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6019?
CVE-2026-6019 is classified as a high-severity vulnerability due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2026-6019?
To mitigate CVE-2026-6019, ensure that your implementation of the http.cookies.Morsel module properly neutralizes sensitive characters in script outputs.
What software is affected by CVE-2026-6019?
CVE-2026-6019 affects the Python http.cookies.Morsel module.
What type of vulnerability is CVE-2026-6019?
CVE-2026-6019 is a cross-site scripting (XSS) vulnerability due to improper handling of embedded characters in generated script tags.
When was CVE-2026-6019 disclosed?
CVE-2026-6019 was disclosed in 2026, following its identification as a security issue within the Python standard library.