Junglewise Threat Intelligence

CVE-2026-6019: Python CPython HTML injection in http.cookies.Morsel.js_output

CVE-2026-6019 · Severity: medium · CVSS 6.1 · Published 2026-04-22

Technologies: Python Software Foundation CPython. Vendors: Python Software Foundation.

Executive brief

A vulnerability in Python's standard library could allow attackers to perform cross-site scripting (XSS) attacks. The affected component is used to generate JavaScript code for handling browser cookies. An attacker could potentially inject malicious scripts into a user's browser, leading to unauthorized actions or the theft of sensitive information.

Technical details

The http.cookies.Morsel.js_output() method in CPython's standard library generates an inline <script> snippet. While it escapes double quotes for JavaScript string context, it fails to neutralize the HTML parser-sensitive sequence '</script>'. This allows an attacker who can control cookie values to break out of the script context and inject arbitrary HTML or JavaScript. The vulnerability is classified as Improper Encoding or Escaping of Output (CWE-116). The fix involves base64-encoding the cookie value within the generated JavaScript to prevent the inclusion of sensitive HTML sequences. Patches have been issued for multiple CPython branches, including 3.13 and 3.14.

Affected products

  • Python Software Foundation CPython up to (excluding) 3.15.0

Timeline

  • 2021-12-22: disclosed: Issue originally reported on GitHub/BPO
  • 2026-04-22: patched: Fix merged into CPython main branch
  • 2026-04-22: advisory: Security announcement published to python.org mailing list
  • 2026-04-22: other: CVE published

References

Related threats