CVE-2026-6019
published 2026-04-22CVE-2026-6019: http.cookies.Morsel.js_output() returns an inline snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive…
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.21%
11.2th percentile
http.cookies.Morsel.js_output() returns an inline snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python3.11 | — | — |
| debian | python3.13 | — | — |
| debian | python3.14 | — | — |
| debian | python3.9 | — | — |
| devspaces | code-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| python | python | < 3.13.14 | 3.13.14 |
| python | python | — | — |
| python | python | — | — |
| python | python | — | — |
| python | python | — | — |
| python | python | — | — |
| python | python | — | — |
| python | python | — | — |
| python | python | — | — |
| python | python | — | — |
| python | python | 3.14.0 – 3.14.4 | — |
| python36_3.6 | python36 | — | — |
| python39-devel_3.9 | python39 | — | — |
| python_software_foundation | cpython | < 3.13.14 | 3.13.14 |
| python_software_foundation | cpython | >= 3.14.0a1 < 3.14.5rc1 | 3.14.5rc1 |
| python_software_foundation | cpython | >= 3.15.0a1 < 3.15.0b1 | 3.15.0b1 |
| rhelai3 | bootc-aws-cuda-rhel9 | — | — |
| rhelai3 | bootc-azure-cuda-rhel9 | — | — |
| rhelai3 | bootc-azure-rocm-rhel9 | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_ubuntu7.5HIGH
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2755-2mm4-rm5c: http
ghsa_unreviewed·2026-04-22
CVE-2026-6019 [LOW] CWE-150 GHSA-2755-2mm4-rm5c: http
http.cookies.Morsel.js_output() returns an inline snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
VulDB
Python CPython up to 3.14.x HTML Parser http.cookies.Morsel.js_output control sequence (ID 90309 / EUVD-2026-25079)
vuldb·2026-04-22·CVSS 2.1
CVE-2026-6019 [LOW] Python CPython up to 3.14.x HTML Parser http.cookies.Morsel.js_output control sequence (ID 90309 / EUVD-2026-25079)
A vulnerability identified as problematic has been detected in Python CPython up to 3.14.x. This affects the function http.cookies.Morsel.js_output of the component HTML Parser. This manipulation causes improper neutralization of escape, meta, or control sequences.
This vulnerability appears as CVE-2026-6019. The attack may be initiated remotely. There is no available exploit.
You should upgrade the affected component.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2026-09-10·CVSS 7.5
CVE-2026-3644 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python's http.cookies module incorrectly handled
control characters in certain cookie operations. An attacker could possibly
use this issue to inject arbitrary content. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)
It was discovered that the Python pyexpat module was vulnerable to
unbounded recursion in the Expat XML parser. An attacker could possibly use
this issue to cause Python to crash, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)
I
Ubuntu
Python vulnerabilities
vendor_ubuntu·2026-07-06·CVSS 3.3
CVE-2026-9669 [LOW] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python incorrectly normalized paths in the tarfile
module. An attacker could possibly use this issue to bypass path
restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04
LTS. (CVE-2025-13462)
It was discovered that Python's HTMLParser incorrectly handled certain
malformed HTML input. An attacker could possibly use this issue to cause
Python to crash, resulting in a denial of service. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)
It was discovered that Python's email module incorrectly quoted newlines
in headers. An attacker could possibly use this issue to inject arbitrary
email headers. This issue only affected Ubuntu 22.04 L
Red Hat
python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module
vendor_redhat·2026-04-22·CVSS 2.1
CVE-2026-6019 [LOW] CWE-79 python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module
python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module
A flaw was found in Python's `http.cookies` module. The `Morsel.js_output()` function, responsible for generating JavaScript output for cookies, does not properly neutralize the `` HTML sequence. This oversight could allow a remote attacker to inject malicious script into a web page, potentially leading to Cross-Site Scripting (XSS) attacks. Such an attack could result in information disclosure or arbitrary code execution within the user's browser.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: python3.
No detection rules found.
No public exploits indexed.
https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76chttps://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8https://github.com/python/cpython/issues/90309https://github.com/python/cpython/pull/148848https://mail.python.org/archives/list/[email protected]/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/
2026-04-22
Published