# CVE-2026-6019: Python CPython HTML injection in http.cookies.Morsel.js_output

Source: https://junglewise.ai/threats/cve-2026-6019-python-cpython-html-injection-in-http-cookies-morsel-js-output  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-6019 · Severity: medium · CVSS 6.1 · Published 2026-04-22

A vulnerability in Python's standard library could allow attackers to perform cross-site scripting (XSS) attacks. The affected component is used to generate JavaScript code for handling browser cookies. An attacker could potentially inject malicious scripts into a user's browser, leading to unauthorized actions or the theft of sensitive information.

Technologies: [Python Software Foundation CPython](https://junglewise.ai/threats/technologies/cpython). Vendors: [Python Software Foundation](https://junglewise.ai/threats/vendors/python-software-foundation).

## Quick answers

**Is CVE-2026-6019 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6019 being exploited in the wild.

**How severe is CVE-2026-6019?** Medium severity, with a CVSS score of 6.1, published 22 April 2026.

**Which products and versions are affected?** Python Software Foundation CPython up to (excluding) 3.15.0.

**Is there a fix for CVE-2026-6019?** A patch was published on 2026-04-22: Fix merged into CPython main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6019 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6019?** Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The http.cookies.Morsel.js_output() method in CPython's standard library generates an inline <script> snippet. While it escapes double quotes for JavaScript string context, it fails to neutralize the HTML parser-sensitive sequence '</script>'. This allows an attacker who can control cookie values to break out of the script context and inject arbitrary HTML or JavaScript. The vulnerability is classified as Improper Encoding or Escaping of Output (CWE-116). The fix involves base64-encoding the cookie value within the generated JavaScript to prevent the inclusion of sensitive HTML sequences. Patches have been issued for multiple CPython branches, including 3.13 and 3.14.

## Affected products

- Python Software Foundation CPython up to (excluding) 3.15.0

## Timeline

- 2021-12-22: disclosed: Issue originally reported on GitHub/BPO
- 2026-04-22: patched: Fix merged into CPython main branch
- 2026-04-22: advisory: Security announcement published to python.org mailing list
- 2026-04-22: other: CVE published

## References

- [https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c](https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c)
- [https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104](https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104)
- [https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8](https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8)
- [https://github.com/python/cpython/issues/90309](https://github.com/python/cpython/issues/90309)
- [https://github.com/python/cpython/pull/148848](https://github.com/python/cpython/pull/148848)
- [https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/](https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/)

## Related threats

- [Python gzip/tarfile/zipfile CLI module shadowing via sys.path](https://junglewise.ai/threats/cve-2026-115791-when-tarfile-or-zipfile-command-line-interface-cli-is-used-to)
- [Python CPython quadratic complexity in xml.etree XPath index predicates](https://junglewise.ai/threats/cve-2026-6879-python-cpython-quadratic-complexity-in-xml-etree-xpath-index)
- [Python CPython CPU denial of service in html.parser.HTMLParser](https://junglewise.ai/threats/cve-2026-15308-python-cpython-cpu-denial-of-service-in-html-parser-htmlparser)
- [Python CPython improper permission preservation in tarfile.extract](https://junglewise.ai/threats/cve-2026-4360-python-cpython-improper-permission-preservation-in-tarfile-extract)
- [Python CPython infinite loop in tarfile streaming mode](https://junglewise.ai/threats/cve-2026-11972-python-cpython-infinite-loop-in-tarfile-streaming-mode)