PT-2026-34549 · Python · Cpython

Oolongeya + 1 · Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-6019

Mitre

CVSS v4.0

2.1

Low

AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

http.cookies.Morsel.js output() returns an inline inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

Fix

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2026-6019

Affected Products

Cpython

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-6019 · Security Note
• https://github.com/python/cpython/pull/148848 · Patch
• https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104 · Patch
• https://mail.python.org/archives/list/[e-mail]/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3 · Vendor Advisory
• https://github.com/python/cpython/issues/90309 · Note