CVE-2026-6019

Name of the Vulnerable Software and Affected Versions Python (affected versions not specified)

Description The js output() function within http.cookies.Morsel returns an inline <script> snippet that only escapes double quotes for JavaScript string context. It fails to neutralize the </script> sequence, which is sensitive to the HTML parser, allowing for potential escaping within the generated script element.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Base64-encode the cookie value to prevent escaping via the cookie value.