inside the generated script element. Mitigation base64-"}},{"@type":"Question","name":"Is CVE-2026-6019 being actively exploited?","acceptedAnswer":{"@type":"Answer","text":"It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 0%."}},{"@type":"Question","name":"What products does CVE-2026-6019 affect?","acceptedAnswer":{"@type":"Answer","text":"Tracked products affected include Python. Check the version you run to see whether it is affected."}},{"@type":"Question","name":"How do I fix CVE-2026-6019?","acceptedAnswer":{"@type":"Answer","text":"Apply the vendor fix in your normal patch cycle. An official patch or advisory is available. Upgrade affected products to a fixed version."}}]},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://isitpatched.com/"},{"@type":"ListItem","position":2,"name":"Actively exploited","item":"https://isitpatched.com/exploited"},{"@type":"ListItem","position":3,"name":"CVE-2026-6019","item":"https://isitpatched.com/cve/CVE-2026-6019"}]}]
Synced 17 Jun 2026 22:27 UTC Account
← All products

CVE-2026-6019

MEDIUM severity · CVSS 6.1 · CWE-150
6.1CVSS MEDIUM

Summary

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

Impact & exploitability

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionRequired
Confidentiality impactLow
Integrity impactLow
Availability impactNone
Exploit probability (EPSS)0%

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products we track (1)

Python

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Official patch: https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c ↗

Additional information