CVE-2026-42874: miguelgrinberg Microdot HTTP header injection in Response.set_cookie

Executive brief

Microdot, a lightweight web framework, is vulnerable to a security flaw where it fails to properly clean data used in website cookies. An attacker could potentially use this to inject malicious headers into a user's web session, though this typically requires the attacker to have already compromised the user's browser through another method. This could lead to unauthorized changes in how the web application behaves for that specific user.

Technical details

The `Response.set_cookie()` method in Microdot does not sanitize its string arguments for carriage return and line feed (`\r\n`) sequences. This vulnerability, classified as CWE-113 (HTTP Response Splitting), allows an attacker to perform HTTP header injection. To exploit this, an attacker must be able to influence the data passed to the cookie-setting function, often requiring a secondary vulnerability like XSS to infiltrate the client. Successful exploitation allows the injection of arbitrary HTTP headers into the response sent to the victim's browser. The issue is fixed in version 2.6.1.

Affected products

• miguelgrinberg microdot < 2.6.1

Timeline

• 2026-04-24: disclosed: Vulnerability reported and published to repository
• 2026-05-05: advisory: GitHub Advisory published
• 2026-05-11: other: NVD published

References

• https://api.github.com/users/luantq0
• https://github.com/luantq0
• https://api.github.com/users/luantq0/gists%7B/gist_id%7D
• https://api.github.com/users/luantq0/repos
• https://avatars.githubusercontent.com/u/128394490?v=4
• https://api.github.com/users/luantq0/events%7B/privacy%7D