Vulnerability · Published Apr 22, 2026 · Assigned by PSF
CVE-2026-6019BaseCookie.js_output() does not neutralize embedded characters
Low 2.1
In plain English
A low-severity security flaw in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)2.1Low
Exploit odds (30 days)0.2%top 88.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | python3.14 | 3.14.5-1.el10_2 | ALSA-2026:28581 |
| AlmaLinux:9 | python3.14 | 3.14.5-1.el9_8 | ALSA-2026:28247 |
| AlmaLinux:10 | python3.14-debug | 3.14.5-1.el10_2 | ALSA-2026:28581 |
| AlmaLinux:9 | python3.14-debug | 3.14.5-1.el9_8 | ALSA-2026:28247 |
| AlmaLinux:10 | python3.14-devel | 3.14.5-1.el10_2 | ALSA-2026:28581 |
| AlmaLinux:9 | python3.14-devel | 3.14.5-1.el9_8 | ALSA-2026:28247 |
| AlmaLinux:10 | python3.14-freethreading | 3.14.5-1.el10_2 | ALSA-2026:28581 |
| AlmaLinux:9 | python3.14-freethreading | 3.14.5-1.el9_8 | ALSA-2026:28247 |
| AlmaLinux:10 | python3.14-freethreading-debug | 3.14.5-1.el10_2 | ALSA-2026:28581 |
| AlmaLinux:9 | python3.14-freethreading-debug | 3.14.5-1.el9_8 | ALSA-2026:28247 |
| AlmaLinux:10 | python3.14-freethreading-devel | 3.14.5-1.el10_2 | ALSA-2026:28581 |
| AlmaLinux:9 | python3.14-freethreading-devel | 3.14.5-1.el9_8 | ALSA-2026:28247 |
| AlmaLinux:10 | python3.14-freethreading-idle | 3.14.5-1.el10_2 | ALSA-2026:28581 |
| AlmaLinux:9 | python3.14-freethreading-idle | 3.14.5-1.el9_8 | ALSA-2026:28247 |
| AlmaLinux:10 | python3.14-freethreading-libs | 3.14.5-1.el10_2 | ALSA-2026:28581 |
| AlmaLinux:9 | python3.14-freethreading-libs | 3.14.5-1.el9_8 | ALSA-2026:28247 |
| AlmaLinux:10 | python3.14-freethreading-test | 3.14.5-1.el10_2 | ALSA-2026:28581 |
| AlmaLinux:9 | python3.14-freethreading-test | 3.14.5-1.el9_8 | ALSA-2026:28247 |
| AlmaLinux:10 | python3.14-freethreading-tkinter | 3.14.5-1.el10_2 | ALSA-2026:28581 |
| AlmaLinux:9 | python3.14-freethreading-tkinter | 3.14.5-1.el9_8 | ALSA-2026:28247 |
| AlmaLinux:10 | python3.14-idle | 3.14.5-1.el10_2 | ALSA-2026:28581 |
| AlmaLinux:9 | python3.14-idle | 3.14.5-1.el9_8 | ALSA-2026:28247 |
| AlmaLinux:10 | python3.14-libs | 3.14.5-1.el10_2 | ALSA-2026:28581 |
| AlmaLinux:9 | python3.14-libs | 3.14.5-1.el9_8 | ALSA-2026:28247 |
| AlmaLinux:10 | python3.14-test | 3.14.5-1.el10_2 | ALSA-2026:28581 |
| AlmaLinux:9 | python3.14-test | 3.14.5-1.el9_8 | ALSA-2026:28247 |
| AlmaLinux:10 | python3.14-tkinter | 3.14.5-1.el10_2 | ALSA-2026:28581 |
| AlmaLinux:9 | python3.14-tkinter | 3.14.5-1.el9_8 | ALSA-2026:28247 |
| Debian:12 | pypy3 | no fix listed | DEBIAN-CVE-2026-6019 |
| Debian:13 | pypy3 | no fix listed | DEBIAN-CVE-2026-6019 |
| Debian:14 | pypy3 | no fix listed | DEBIAN-CVE-2026-6019 |
| Debian:12 | python3.11 | 3.11.2-6+deb12u9 | DEBIAN-CVE-2026-6019 |
| Debian:13 | python3.13 | 3.13.5-2+deb13u2 | DEBIAN-CVE-2026-6019 |
| Debian:14 | python3.14 | 3.14.5~rc1-1 | DEBIAN-CVE-2026-6019 |
| Rocky Linux:10 | python3.14 | 0:3.14.5-1.el10_2 | RLSA-2026:28581 |
| Rocky Linux:9 | python3.14 | 0:3.14.5-1.el9_8 | RLSA-2026:28247 |
| Ubuntu:22.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-6019 |
| Ubuntu:24.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-6019 |
| Ubuntu:25.10 | pypy3 | no fix listed | UBUNTU-CVE-2026-6019 |
| Ubuntu:26.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-6019 |
| Ubuntu:26.10 | pypy3 | no fix listed | UBUNTU-CVE-2026-6019 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.18 | USN-8744-1 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.16 | UBUNTU-CVE-2026-6019 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.16 | USN-8509-1 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.17 | USN-8744-1 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.15 | USN-8509-1 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.15 | UBUNTU-CVE-2026-6019 |
| Ubuntu:25.10 | python3.13 | no fix listed | UBUNTU-CVE-2026-6019 |
| Ubuntu:25.10 | python3.14 | no fix listed | UBUNTU-CVE-2026-6019 |
| Ubuntu:26.04:LTS | python3.14 | 3.14.4-1ubuntu0.2 | USN-8744-1 |
| Ubuntu:26.04:LTS | python3.14 | 3.14.4-1ubuntu0.1 | USN-8509-1 |
| Ubuntu:26.04:LTS | python3.14 | 3.14.4-1ubuntu0.1 | UBUNTU-CVE-2026-6019 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.13.143.14.0a1 – before 3.14.5rc13.15.0a1 – before 3.15.0b1 |
Weakness: CWE-150 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/python/cpython/pull/148848 patch
- https://github.com/python/cpython/issues/90309 issue-tracking
- https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/ vendor-advisory
- https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104 patch
- https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c patch
- https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8 patch