Vulnerability-Lookup

CVE-2026-6019 (GCVE-0-2026-6019)

Vulnerability from cvelistv5 – Published: 2026-04-22 19:28 – Updated: 2026-06-10 18:58

Title

BaseCookie.js_output() does not neutralize embedded characters

Summary

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-22 20:02 UTC

CWE

CWE-150 - Improper neutralization of escape, meta, or control sequences

Assigner

PSF mitre root

References

6 references

URL	Tags
https://github.com/python/cpython/pull/148848	patch
https://github.com/python/cpython/issues/90309	issue-tracking
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/76b3923d…	patch
https://github.com/python/cpython/commit/3c59b8b5…	patch
https://github.com/python/cpython/commit/f795e042…	patch

Impacted products

1 product

Vendor	Product	Version	CPE status
Python Software Foundation	CPython	Affected: 0 , < 3.13.14 (python) Affected: 3.14.0a1 , < 3.14.5rc1 (python) Affected: 3.15.0a1 , < 3.15.0b1 (python)	guessed

Credits

oolongeya (https://github.com/komi22) Seth Larson (https://github.com/sethmlarson)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6019",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T20:02:17.071906Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T20:02:34.468Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.13.14",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.5rc1",
              "status": "affected",
              "version": "3.14.0a1",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0b1",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "oolongeya (https://github.com/komi22)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Seth Larson (https://github.com/sethmlarson)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ccode\u003ehttp.cookies.Morsel.js_output()\u003c/code\u003e returns an inline \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e snippet and only escapes \u003ccode\u003e\"\u003c/code\u003e for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence \u003ccode\u003e\u0026lt;/script\u0026gt;\u003c/code\u003e inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value."
            }
          ],
          "value": "http.cookies.Morsel.js_output() returns an inline \u003cscript\u003e snippet and only escapes \" for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence \u003c/script\u003e inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150 Improper neutralization of escape, meta, or control sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T18:58:07.798Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/148848"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/90309"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "BaseCookie.js_output() does not neutralize embedded characters",
      "x_generator": {
        "engine": "Vulnogram 0.6.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-6019",
    "datePublished": "2026-04-22T19:28:08.720Z",
    "dateReserved": "2026-04-09T15:35:00.668Z",
    "dateUpdated": "2026-06-10T18:58:07.798Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-6019",
      "date": "2026-09-14",
      "epss": "0.00229",
      "percentile": "0.13759"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-09T14:48:20.000Z",
      "cve": "CVE-2026-6019",
      "id": "msrc_CVE-2026-6019",
      "initial_release_date": "2026-04-29T01:10:33.000Z",
      "product_status:known_affected": "6",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "BaseCookie.js_output() does not neutralize embedded characters",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-6019.json",
      "version": "6"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-6019\",\"sourceIdentifier\":\"cna@python.org\",\"published\":\"2026-04-22T20:16:42.617\",\"lastModified\":\"2026-07-27T17:34:54.330\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"http.cookies.Morsel.js_output() returns an inline \u003cscript\u003e snippet and only escapes \\\" for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence \u003c/script\u003e inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.\"}],\"affected\":[{\"source\":\"cna@python.org\",\"affectedData\":[{\"vendor\":\"Python Software Foundation\",\"product\":\"CPython\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://github.com/python/cpython\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"3.13.14\",\"versionType\":\"python\",\"status\":\"affected\"},{\"version\":\"3.14.0a1\",\"lessThan\":\"3.14.5rc1\",\"versionType\":\"python\",\"status\":\"affected\"},{\"version\":\"3.15.0a1\",\"lessThan\":\"3.15.0b1\",\"versionType\":\"python\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cna@python.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.1,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-22T20:02:17.071906Z\",\"id\":\"CVE-2026-6019\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"cna@python.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-150\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-116\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.13.14\",\"matchCriteriaId\":\"16DAC42F-7128-49F8-B799-78D78580EC70\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.14.0\",\"versionEndIncluding\":\"3.14.4\",\"matchCriteriaId\":\"E819F5F6-4D1E-4965-BAEA-B730ECE9713C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3327507-0B1D-4F28-A983-D07A2C8A7696\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C8AF17F1-A27F-4C98-BA5A-B4319710E8D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*\",\"matchCriteriaId\":\"24CF56B0-2F4E-42A2-B655-F493AA0A4815\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*\",\"matchCriteriaId\":\"7184ABBA-B100-489E-B5C1-1C9EEC0546CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6D4181B-3E1B-499B-AAB1-50868A6A6AD3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*\",\"matchCriteriaId\":\"A52F6DD2-717D-4E8C-8DB7-00890BC1ABAE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C46C55C-801E-4F86-B669-8E6A12B4AB6F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:python:python:3.15.0:alpha8:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A8DF8E5-61F9-4899-BF40-41A17E223441\"}]}]}],\"references\":[{\"url\":\"https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c\",\"source\":\"cna@python.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104\",\"source\":\"cna@python.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8\",\"source\":\"cna@python.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/python/cpython/issues/90309\",\"source\":\"cna@python.org\",\"tags\":[\"Exploit\",\"Issue Tracking\"]},{\"url\":\"https://github.com/python/cpython/pull/148848\",\"source\":\"cna@python.org\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/\",\"source\":\"cna@python.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-21T17:14:25+00:00",
      "cve": "CVE-2026-6019",
      "id": "CVE-2026-6019",
      "initial_release_date": "2026-04-22T19:28:08.720000+00:00",
      "product_status:fixed": "177",
      "product_status:known_affected": "185",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6019.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-09-07T16:31:33Z",
      "cve": "CVE-2026-6019",
      "id": "CVE-2026-6019",
      "initial_release_date": "2026-04-24T01:34:56Z",
      "product_status:known_affected": "529",
      "product_status:known_not_affected": "15",
      "product_status:recommended": "817",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-6019",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-6019.json",
      "version": "31"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-6019\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-22T20:02:17.071906Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-22T20:02:21.519Z\"}}], \"cna\": {\"title\": \"BaseCookie.js_output() does not neutralize embedded characters\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"oolongeya (https://github.com/komi22)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Seth Larson (https://github.com/sethmlarson)\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 2.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"HIGH\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/python/cpython\", \"vendor\": \"Python Software Foundation\", \"product\": \"CPython\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"3.15.0\", \"versionType\": \"python\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/python/cpython/pull/148848\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/python/cpython/issues/90309\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.6.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"http.cookies.Morsel.js_output() returns an inline \u003cscript\u003e snippet and only escapes \\\" for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence \u003c/script\u003e inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003ccode\u003ehttp.cookies.Morsel.js_output()\u003c/code\u003e returns an inline \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e snippet and only escapes \u003ccode\u003e\\\"\u003c/code\u003e for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence \u003ccode\u003e\u0026lt;/script\u0026gt;\u003c/code\u003e inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-150\", \"description\": \"CWE-150 Improper neutralization of escape, meta, or control sequences\"}]}], \"providerMetadata\": {\"orgId\": \"28c92f92-d60d-412d-b760-e73465c3df22\", \"shortName\": \"PSF\", \"dateUpdated\": \"2026-04-29T15:31:09.049Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-6019\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-29T15:31:09.049Z\", \"dateReserved\": \"2026-04-09T15:35:00.668Z\", \"assignerOrgId\": \"28c92f92-d60d-412d-b760-e73465c3df22\", \"datePublished\": \"2026-04-22T19:28:08.720Z\", \"assignerShortName\": \"PSF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

alsa-2026:28247

Vulnerability from osv_almalinux

Published

2026-06-23 00:00

Modified

2026-06-25 10:16

Summary

Important: python3.14 security, bug fix, and enhancement update

Details

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)

Bug Fix(es) and Enhancement(s):

[9.8.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-180642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:28247	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-4786	REPORT
	https://access.redhat.com/security/cve/CVE-2026-6019	REPORT
	https://bugzilla.redhat.com/2458049	REPORT
	https://bugzilla.redhat.com/2460869	REPORT
	https://errata.almalinux.org/9/ALSA-2026-28247.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-freethreading"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-freethreading-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-freethreading-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-freethreading-idle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-freethreading-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-freethreading-test"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-freethreading-tkinter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-idle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-test"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.14-tkinter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)\n  * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * [9.8.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-180642)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:28247",
  "modified": "2026-06-25T10:16:30Z",
  "published": "2026-06-23T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:28247"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-4786"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-6019"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2458049"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2460869"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2026-28247.html"
    }
  ],
  "related": [
    "CVE-2026-4786",
    "CVE-2026-6019"
  ],
  "summary": "Important: python3.14 security, bug fix, and enhancement update"
}

alsa-2026:28581

Vulnerability from osv_almalinux

Published

2026-06-23 00:00

Modified

2026-06-24 09:23

Summary

Important: python3.14 security, bug fix, and enhancement update

Details

Security Fix(es):

python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)

Bug Fix(es) and Enhancement(s):

[10.2.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-176147)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:28581	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-4786	REPORT
	https://access.redhat.com/security/cve/CVE-2026-6019	REPORT
	https://bugzilla.redhat.com/2458049	REPORT
	https://bugzilla.redhat.com/2460869	REPORT
	https://errata.almalinux.org/10/ALSA-2026-28581.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-freethreading"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-freethreading-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-freethreading-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-freethreading-idle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-freethreading-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-freethreading-test"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-freethreading-tkinter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-idle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-test"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3.14-tkinter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.5-1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)\n  * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * [10.2.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-176147)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:28581",
  "modified": "2026-06-24T09:23:59Z",
  "published": "2026-06-23T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:28581"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-4786"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-6019"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2458049"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2460869"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-28581.html"
    }
  ],
  "related": [
    "CVE-2026-4786",
    "CVE-2026-6019"
  ],
  "summary": "Important: python3.14 security, bug fix, and enhancement update"
}

bit-libpython-2026-6019

Vulnerability from bitnami_vulndb

Published

2026-06-25 07:36

Modified

2026-09-10 15:46

Summary

BaseCookie.js_output() does not neutralize embedded characters

Details

http.cookies.Morsel.js_output() returns an inline snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "libpython",
        "purl": "pkg:bitnami/libpython"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.13.14"
            },
            {
              "introduced": "3.14.0"
            },
            {
              "fixed": "3.14.5"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-6019"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
  },
  "details": "http.cookies.Morsel.js_output() returns an inline \u003cscript\u003e snippet and only escapes \" for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence \u003c/script\u003e inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.",
  "id": "BIT-libpython-2026-6019",
  "modified": "2026-09-10T15:46:03.895Z",
  "published": "2026-06-25T07:36:30.325Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/python/cpython/issues/90309"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/pull/148848"
    },
    {
      "type": "ADVISORY",
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6019"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "BaseCookie.js_output() does not neutralize embedded characters"
}

bit-python-2026-6019

Vulnerability from bitnami_vulndb

Published

2026-06-25 07:40

Modified

2026-09-10 15:46

Summary

BaseCookie.js_output() does not neutralize embedded characters

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "python",
        "purl": "pkg:bitnami/python"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.13.14"
            },
            {
              "introduced": "3.14.0"
            },
            {
              "fixed": "3.14.5"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-6019"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
  },
  "details": "http.cookies.Morsel.js_output() returns an inline \u003cscript\u003e snippet and only escapes \" for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence \u003c/script\u003e inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.",
  "id": "BIT-python-2026-6019",
  "modified": "2026-09-10T15:46:03.895Z",
  "published": "2026-06-25T07:40:44.360Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/python/cpython/issues/90309"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/pull/148848"
    },
    {
      "type": "ADVISORY",
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6019"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "BaseCookie.js_output() does not neutralize embedded characters"
}

CERTFR-2026-AVI-0482

Vulnerability from certfr_avis - Published: 2026-04-23 - Updated: 2026-04-23

Une vulnérabilité a été découverte dans CPython. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Python	CPython	CPython sans le dernier correctif de sécurité

References

Title

Publication Time

FKIE_CVE-2026-6019

Vulnerability from fkie_nvd - Published: 2026-04-22 20:16 - Updated: 2026-07-27 17:34

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
cna@python.org	https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c	Patch
cna@python.org	https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104	Patch
cna@python.org	https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8	Patch
cna@python.org	https://github.com/python/cpython/issues/90309	Exploit, Issue Tracking
cna@python.org	https://github.com/python/cpython/pull/148848	Issue Tracking, Patch
cna@python.org	https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/	Mailing List, Vendor Advisory

Impacted products

Vendor	Product	Version
python	python	*
python	python	*
python	python	3.15.0
python	python	3.15.0
python	python	3.15.0
python	python	3.15.0
python	python	3.15.0
python	python	3.15.0
python	python	3.15.0
python	python	3.15.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.13.14",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.5rc1",
              "status": "affected",
              "version": "3.14.0a1",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.0b1",
              "status": "affected",
              "version": "3.15.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "source": "cna@python.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "16DAC42F-7128-49F8-B799-78D78580EC70",
              "versionEndExcluding": "3.13.14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E819F5F6-4D1E-4965-BAEA-B730ECE9713C",
              "versionEndIncluding": "3.14.4",
              "versionStartIncluding": "3.14.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*",
              "matchCriteriaId": "A3327507-0B1D-4F28-A983-D07A2C8A7696",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*",
              "matchCriteriaId": "C8AF17F1-A27F-4C98-BA5A-B4319710E8D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*",
              "matchCriteriaId": "24CF56B0-2F4E-42A2-B655-F493AA0A4815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*",
              "matchCriteriaId": "7184ABBA-B100-489E-B5C1-1C9EEC0546CA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*",
              "matchCriteriaId": "B6D4181B-3E1B-499B-AAB1-50868A6A6AD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*",
              "matchCriteriaId": "A52F6DD2-717D-4E8C-8DB7-00890BC1ABAE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*",
              "matchCriteriaId": "8C46C55C-801E-4F86-B669-8E6A12B4AB6F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:3.15.0:alpha8:*:*:*:*:*:*",
              "matchCriteriaId": "5A8DF8E5-61F9-4899-BF40-41A17E223441",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "http.cookies.Morsel.js_output() returns an inline \u003cscript\u003e snippet and only escapes \" for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence \u003c/script\u003e inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value."
    }
  ],
  "id": "CVE-2026-6019",
  "lastModified": "2026-07-27T17:34:54.330",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.1,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "HIGH",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "cna@python.org",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-6019",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-22T20:02:17.071906Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-22T20:16:42.617",
  "references": [
    {
      "source": "cna@python.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c"
    },
    {
      "source": "cna@python.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104"
    },
    {
      "source": "cna@python.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8"
    },
    {
      "source": "cna@python.org",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "url": "https://github.com/python/cpython/issues/90309"
    },
    {
      "source": "cna@python.org",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/python/cpython/pull/148848"
    },
    {
      "source": "cna@python.org",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/"
    }
  ],
  "sourceIdentifier": "cna@python.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-150"
        }
      ],
      "source": "cna@python.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-2755-2MM4-RM5C

Vulnerability from github – Published: 2026-04-22 21:32 – Updated: 2026-05-18 18:31

Details

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

2.1 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-6019"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-150"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-22T20:16:42Z",
    "severity": "LOW"
  },
  "details": "http.cookies.Morsel.js_output() returns an inline \u003cscript\u003e snippet and only escapes \" for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence \u003c/script\u003e inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.",
  "id": "GHSA-2755-2mm4-rm5c",
  "modified": "2026-05-18T18:31:23Z",
  "published": "2026-04-22T21:32:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6019"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python/cpython/issues/90309"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python/cpython/pull/148848"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8"
    },
    {
      "type": "WEB",
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

MSRC_CVE-2026-6019

Vulnerability from csaf_microsoft - Published: 2026-04-29 01:10 - Updated: 2026-09-09 14:48

Summary

BaseCookie.js_output() does not neutralize embedded characters

Scope

1 vulnerability in this advisory, including CVE-2026-6019.

CVE-2026-6019

Known affected: 6 products Known not affected: 1 product

Open the full advisory

OPENSUSE-SU-2026:10647-1

Vulnerability from csaf_opensuse - Published: 2026-04-28 00:00 - Updated: 2026-04-28 00:00

Summary

python310-3.10.20-6.1 on GA media

Severity

Moderate

Scope

4 vulnerabilities in this advisory, including CVE-2026-6019.

CVE-2026-6019

3.8 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Recommended: 20 products

Open the full advisory

OPENSUSE-SU-2026:10648-1

Vulnerability from csaf_opensuse - Published: 2026-04-28 00:00 - Updated: 2026-04-28 00:00

Summary

python315-3.15.0~a8-3.1 on GA media

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2026-6019.

CVE-2026-6019

3.8 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Recommended: 28 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-6019 (GCVE-0-2026-6019)

Vulnerability from osv_almalinux

Vulnerability from osv_almalinux

Vulnerability from bitnami_vulndb

Vulnerability from bitnami_vulndb

Solutions

Tags

Sightings

Nomenclature