Is CVE-2026-6019 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6019 being exploited in the wild.

How severe is CVE-2026-6019?

Medium severity, with a CVSS score of 6.1, published 22 April 2026.

Which products and versions are affected?

Python Software Foundation CPython up to (excluding) 3.15.0.

Is there a fix for CVE-2026-6019?

A patch was published on 2026-04-22: Fix merged into CPython main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6019 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6019?

Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6019: Python CPython HTML injection in http.cookies.Morsel.js_output

CVE-2026-6019 · Severity: medium · CVSS 6.1 · Published 2026-04-22

A vulnerability in Python's standard library could allow attackers to perform cross-site scripting (XSS) attacks. The affected component is used to generate JavaScript code for handling browser cookies. An attacker could potentially inject malicious scripts into a user's browser, leading to unauthorized actions or the theft of sensitive information.

Technologies: Python Software Foundation CPython. Vendors: Python Software Foundation.

Quick answers

Is CVE-2026-6019 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6019 being exploited in the wild.
How severe is CVE-2026-6019?: Medium severity, with a CVSS score of 6.1, published 22 April 2026.
Which products and versions are affected?: Python Software Foundation CPython up to (excluding) 3.15.0.
Is there a fix for CVE-2026-6019?: A patch was published on 2026-04-22: Fix merged into CPython main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6019 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6019?: Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The http.cookies.Morsel.js_output() method in CPython's standard library generates an inline <script> snippet. While it escapes double quotes for JavaScript string context, it fails to neutralize the HTML parser-sensitive sequence '</script>'. This allows an attacker who can control cookie values to break out of the script context and inject arbitrary HTML or JavaScript. The vulnerability is classified as Improper Encoding or Escaping of Output (CWE-116). The fix involves base64-encoding the cookie value within the generated JavaScript to prevent the inclusion of sensitive HTML sequences. Patches have been issued for multiple CPython branches, including 3.13 and 3.14.

Affected products

Python Software Foundation CPython up to (excluding) 3.15.0

Timeline

2021-12-22: disclosed: Issue originally reported on GitHub/BPO
2026-04-22: patched: Fix merged into CPython main branch
2026-04-22: advisory: Security announcement published to python.org mailing list
2026-04-22: other: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.