CVE-2026-6019: Python

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

Affected products

• Python Python: before 3.13.14 (fixed in 3.13.14); from 3.14.0, up to and including 3.14.4; version 3.15.0 only

Published 2026-04-22. Last modified 2026-07-27.