CVE-2026-6019: BaseCookie.js_output() does not neutralize embedded characters
Analyzed
AliasesRHSA-2026:22952RHSA-2026:32980RHSA-2026:32997RHSA-2026:33885UBUNTU-CVE-2026-6019DEBIAN-CVE-2026-6019CGA-2rxc-qq2g-w4hfCGA-477g-5pph-75mjCGA-4q3r-438p-rwv3CGA-5qxj-c966-pvpwCGA-6rw5-pv82-g8jwCGA-g7j7-w4vj-6cfxCGA-hjp9-xq8m-3jr3CGA-m623-m4mg-xfgpCGA-qpp8-2qh9-qw2xCGA-qxmw-675j-q4q2CGA-5gw4-663p-cc7qCGA-cmfw-mf93-h33m
Published 22-04-2026Last modified 10-06-2026
Vulnerability summary
CVE-2026-6019 is a medium (CVSS 6.1) vulnerability in python software foundation cpython. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.3% of scored vulnerabilities. 1 public exploit is recorded.
Priority
Routine
Not severe (CVSS 2.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
6.1/10
010
Medium · v3.1 (NVD)EPSS score
0.21%
0%100%
Low · -0.37 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 31 · Related 28OPENSUSE-SU-2026:10647-1OPENSUSE-SU-2026:10648-1OPENSUSE-SU-2026:10667-1OPENSUSE-SU-2026:11068-1OPENSUSE-SU-2026:11100-1OPENSUSE-SU-2026:11181-1OPENSUSE-SU-2026:21459-1RHSA-2026:28247RHSA-2026:28581RHSA-2026:57660RHSA-2026:58420SUSE-SU-2026:22959-1SUSE-SU-2026:23191-1SUSE-SU-2026:23212-1SUSE-SU-2026:2387-1SUSE-SU-2026:2464-1SUSE-SU-2026:2664-1SUSE-SU-2026:3104-1SUSE-SU-2026:3132-1SUSE-SU-2026:3601-1SUSE-SU-2026:3648-1SUSE-SU-2026:3855-1SUSE-SU-2026:4580-1SUSE-SU-2026:4581-1SUSE-SU-2026:4582-1SUSE-SU-2026:4583-1SUSE-SU-2026:4584-1SUSE-SU-2026:4585-1SUSE-SU-2026:4754-1USN-8509-1USN-8744-1CGA-R9HF-494W-36F7
Timeline
- 22-04-2026PublishedVulnerability first disclosed.
- 10-06-2026Last modifiedVulnerability information updated.
Description
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
CVSS metrics
9 scores · 7 sources · 2 versionsLow 2.1Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated2.1LowCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated2.1LowCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated2.1LowCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- NVDNIST2.1LowCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 6.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSources4 sources · 6.1–6.8
- OSV · Red hatEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
Decrease -0.37 pp
From 0.58% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundCpython
Maturity: poc
Weaknesses
CWE · root cause- CWE-150Improper Neutralization of Escape, Meta, or Control SequencesThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
- CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Affected systems
Version check
Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat39 products
- python-unversioned-command< 0:3.14.5-2.hum1
- python3< 0:3.14.5-2.hum1
- python3-debug< 0:3.14.5-2.hum1
- python3-devel< 0:3.14.5-2.hum1
- python3-idle< 0:3.14.5-2.hum1
Ubuntu13 products
- pypy3All versions (No fix recorded)
- python2.7< 2.7.6-8ubuntu0.6+esm30 | < 2.7.12-1ubuntu0~16.04.18+esm22 | < 2.7.17-1~18.04ubuntu1.13+esm15 | < 2.7.18-13ubuntu1.5+esm9
- python3.10< 3.10.12-1~22.04.16
- python3.11< 3.11.0~rc1-1~22.04.1+esm2
- python3.12< 3.12.3-1ubuntu0.15
Chainguard6 products
- python-3.10All versions (No fix recorded)
- python-3.11All versions (No fix recorded)
- python-3.12All versions (No fix recorded) | < 3.12.16-r2
- python-3.13< 3.13.13-r3
- python-3.14< 3.14.4-r4
Wolfi5 products
- python-3.10All versions (No fix recorded)
- python-3.11All versions (No fix recorded)
- python-3.12All versions (No fix recorded) | < 3.12.16-r2
- python-3.13< 3.13.13-r3
- python-3.14< 3.14.4-r4
Debian4 products
- pypy3All versions (No fix recorded)
- python3.11< 3.11.2-6+deb12u9
- python3.13< 3.13.14-1 | < 3.13.5-2+deb13u2
- python3.14< 3.14.5~rc1-1
Python1 product
- python< 3.13.14 | ≥ 3.14.0, ≤ 3.14.4 | 3.15.0:alpha1 | 3.15.0:alpha2 | 3.15.0:alpha3 | 3.15.0:alpha4 | 3.15.0:alpha5 | 3.15.0:alpha6 | 3.15.0:alpha7 | 3.15.0:alpha8
Python software foundation1 product
- cpython< 3.13.14 | ≥ 3.14.0a1, < 3.14.5rc1 | ≥ 3.15.0a1, < 3.15.0b1
7 vendors · 69 products
References
26 links- mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/Vendor AdvisoryARTICLEREPORTAdvisoryMailing List
- images.redhat.comARTICLE
Show all 26 references
- github.com/python/cpythonPACKAGE