PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6019 Python Software Foundation CVE debrief

A vulnerability in Python's http.cookies.Morsel.js_output() method allows HTML injection through insufficient escaping. The method generates an inline <script> element containing cookie data, escaping only double quotes for JavaScript string safety but failing to neutralize the </script> sequence. This permits an attacker with control over cookie values to prematurely close the script element and inject arbitrary HTML. The CVSS 4.0 vector indicates network attack vector with low attack complexity, privileged access required, and low impacts to confidentiality and integrity. The issue affects CPython versions prior to 3.15.0. The Python security team addressed this by base64-encoding cookie values to prevent parser escape sequences from functioning.

Vendor
Python Software Foundation
Product
CPython
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-22
Original CVE updated
2026-07-27
Advisory published
2026-04-22
Advisory updated
2026-07-27

Who should care

Organizations running Python web applications that use http.cookies.Morsel.js_output() to generate client-side cookie-setting scripts; security teams assessing HTML injection risks in legacy Python applications; developers maintaining applications with server-generated JavaScript cookie handling

Technical summary

The http.cookies.Morsel.js_output() method in Python's standard library generates JavaScript code for setting cookies in browser environments. The implementation escapes double quotes to protect JavaScript string context but does not escape HTML-sensitive sequences, specifically </script>. An attacker controlling cookie values can inject this sequence to terminate the script element prematurely, enabling arbitrary HTML injection into the document. The fix base64-encodes the cookie value, preventing the HTML parser from recognizing escape sequences within the encoded data. This vulnerability requires privileged access to cookie values and has limited impact due to the specific usage context of js_output().

Defensive priority

low

Recommended defensive actions

  • Upgrade CPython to version 3.15.0 or later to obtain the base64-encoding mitigation for js_output()
  • Audit applications using http.cookies.Morsel.js_output() for cookie value injection points
  • Validate and sanitize cookie values before passing to js_output() if patching is not immediately feasible
  • Review web application Content Security Policy to restrict inline script execution where possible
  • Monitor python.org security-announce mailing list for related advisories

Evidence notes

Official CVE record published 2026-04-22; NVD analysis completed with vendor patches confirmed. Multiple commits address the escaping deficiency. Vendor advisory issued via python.org security-announce mailing list.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6019 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6019

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6019 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6019

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.