PT-2026-34549 · Python+3 · Python+3
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Python (affected versions not specified)
Description
The
js output() function within http.cookies.Morsel returns an inline <script> snippet that only escapes double quotes for JavaScript string context. It fails to neutralize the </script> sequence, which is sensitive to the HTML parser, allowing for potential escaping within the generated script element.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Base64-encode the cookie value to prevent escaping via the cookie value.
Exploit
DoS
Improper Encoding or Escaping of Output
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Python
Red Os
Rocky Linux