PT-2026-37286 · Pypi · Microdot

Luantq0 · Published 2026-05-05 · Updated 2026-05-11 · CVE-2026-42874

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions microdot versions prior to 2.6.1

Description The Response.set cookie() function does not sanitize string arguments, failing to detect the r sequence. This allows for HTTP response splitting and header injection attacks. For this to be exploited, an attacker must first compromise the client, such as through a Cross-Site Scripting (XSS) attack, to send malicious data that the server then stores in a cookie for the victim. This type of attack is limited to the specific infiltrated client.

Recommendations Upgrade to version 2.6.1. As a temporary workaround, do not pass untrusted data to the Response.set cookie() function.

Fix

Weakness Enumeration

CWE-113

Related Identifiers

CVE-2026-42874

GHSA-7WC8-WVC4-M498

Affected Products

Microdot

References · 7

• https://osv.dev/vulnerability/GHSA-7wc8-wvc4-m498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42874 · Security Note
• https://github.com/miguelgrinberg/microdot/commit/99b281b45faef8472410f2d56bfef496dfbd95d5 · Note
• https://github.com/miguelgrinberg/microdot/blob/main/CHANGES.md · Note
• https://github.com/miguelgrinberg/microdot · Note
• https://github.com/miguelgrinberg/microdot/security/advisories/GHSA-7wc8-wvc4-m498 · Note
• https://twitter.com/luantq0/status/2053327085662531817 · Twitter Post