PT-2026-34549 · Python · Python

Oolongeya + 1 · Published 2026-04-22 · Updated 2026-06-12 · CVE-2026-6019

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Python (affected versions not specified)

Description The js output() function in http.cookies.Morsel returns an inline within the generated script element, which could allow for script injection.

Recommendations As a temporary workaround, consider restricting the use of the js output() function until a patch is available. Base64-encode the cookie value to prevent escaping via the cookie value.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

CWE-150

Related Identifiers

BIT-LIBPYTHON-2026-6019

BIT-PYTHON-2026-6019

BIT-PYTHON-MIN-2026-6019

CVE-2026-6019

ECHO-1E4C-228C-95EE

OESA-2026-2269

OESA-2026-2270

OESA-2026-2271

OPENSUSE-SU-2026:10647-1

OPENSUSE-SU-2026:10648-1

OPENSUSE-SU-2026:10667-1

PSF-2026-21

SUSE-SU-2026:2387-1

Affected Products

Python

References · 46

• 🔥 https://github.com/python/cpython/issues/90309 · Exploit
• https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c · Patch
• https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8 · Patch
• https://github.com/python/cpython/pull/148848 · Patch
• https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104 · Patch
• https://osv.dev/vulnerability/BIT-libpython-2026-6019 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-6019 · Security Note
• https://ubuntu.com/security/CVE-2026-6019 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-6019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6019 · Security Note
• https://mail.python.org/archives/list/[e-mail]/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10667-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2270 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-6019 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-python-min-2026-6019 · Vendor Advisory