inside the generated script element. Mitigation base64-encodes the cookie value to disallow esc","datePublished":"2026-04-22T20:16:42.617Z","dateModified":"2026-07-27T17:34:54.33Z","publisher":{"@type":"Organization","@id":"https://portal.vyprsec.ai#publisher","name":"VYPR","url":"https://portal.vyprsec.ai","logo":{"@type":"ImageObject","url":"https://portal.vyprsec.ai/icon.svg","width":64,"height":64},"description":"Real-time CVE intelligence newsroom — feeds, exploits, vendor advisories, and AI-synthesized insights."},"author":{"@type":"Organization","@id":"https://portal.vyprsec.ai#publisher","name":"VYPR","url":"https://portal.vyprsec.ai","logo":{"@type":"ImageObject","url":"https://portal.vyprsec.ai/icon.svg","width":64,"height":64},"description":"Real-time CVE intelligence newsroom — feeds, exploits, vendor advisories, and AI-synthesized insights."},"proficiencyLevel":"Expert","about":{"@type":"Thing","@id":"https://nvd.nist.gov/vuln/detail/CVE-2026-6019","name":"CVE-2026-6019","identifier":"CVE-2026-6019","description":"http.cookies.Morsel.js_output() returns an inline inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.","additionalType":"https://schema.org/SoftwareApplication","sameAs":["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6019"]},"keywords":"CVE-2026-6019, Medium, CWE-116, CWE-150, Python (programming language) Python, Python (programming language) Python, Python (programming language) Python, Python (programming language) Python, Python (programming language) Python, Python (programming language) Python, Python (programming language) Python, Python (programming language) Python, Python (programming language) Python, Python (programming language) Python, Python (programming language) Python","mentions":[{"@type":"SoftwareApplication","name":"Python","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Python (programming language)"}},{"@type":"SoftwareApplication","name":"Python","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Python (programming language)"}},{"@type":"SoftwareApplication","name":"Python","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Python (programming language)"}},{"@type":"SoftwareApplication","name":"Python","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Python (programming language)"}},{"@type":"SoftwareApplication","name":"Python","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Python (programming language)"}},{"@type":"SoftwareApplication","name":"Python","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Python (programming language)"}},{"@type":"SoftwareApplication","name":"Python","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Python (programming language)"}},{"@type":"SoftwareApplication","name":"Python","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Python (programming language)"}},{"@type":"SoftwareApplication","name":"Python","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Python (programming language)"}},{"@type":"SoftwareApplication","name":"Python","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Python (programming language)"}},{"@type":"SoftwareApplication","name":"Python","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Python (programming language)"}}],"isAccessibleForFree":true},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://portal.vyprsec.ai/"},{"@type":"ListItem","position":2,"name":"CVEs","item":"https://portal.vyprsec.ai/cves"},{"@type":"ListItem","position":3,"name":"CVE-2026-6019","item":"https://portal.vyprsec.ai/cves/CVE-2026-6019"}]}]}

Medium severity6.1NVD Advisory· Published Apr 22, 2026· Updated Jul 27, 2026

CVE-2026-6019

Description

http.cookies.Morsel.js_output() returns an inline inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Python (programming language)/Pythonreferences11 versions
(expand)+ 10 more
- (no CPE)
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:*range: <3.13.14
- cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.15.0:alpha8:*:*:*:*:*:*
- (no CPE)
osv-coords37 versions
pkg:apk/chainguard/python-3.13 pkg:apk/chainguard/python-3.14 pkg:apk/wolfi/python-3.13 pkg:apk/wolfi/python-3.14 pkg:bitnami/libpython pkg:bitnami/python pkg:bitnami/python-min pkg:rpm/almalinux/python3.14 pkg:rpm/almalinux/python3.14-debug pkg:rpm/almalinux/python3.14-devel pkg:rpm/almalinux/python3.14-freethreading pkg:rpm/almalinux/python3.14-freethreading-debug pkg:rpm/almalinux/python3.14-freethreading-devel pkg:rpm/almalinux/python3.14-freethreading-idle pkg:rpm/almalinux/python3.14-freethreading-libs pkg:rpm/almalinux/python3.14-freethreading-test pkg:rpm/almalinux/python3.14-freethreading-tkinter pkg:rpm/almalinux/python3.14-idle pkg:rpm/almalinux/python3.14-libs pkg:rpm/almalinux/python3.14-test pkg:rpm/almalinux/python3.14-tkinter pkg:rpm/opensuse/python3&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/python310&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/python311&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/python312&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/python313&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/python313&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/python313-core&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/python313-documentation&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/python313-nogil&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/python313-nogil-nogil-core&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/python314&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/python315&distro=openSUSE%20Tumbleweed pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/python313&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%203%2015%20SP7 pkg:rpm/suse/python313-core&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%203%2015%20SP7
< 3.13.13-r3+ 36 more
- (no CPE)range: < 3.13.13-r3
- (no CPE)range: < 3.14.4-r4
- (no CPE)range: < 3.13.13-r3
- (no CPE)range: < 3.14.4-r4
- (no CPE)range: < 3.13.14
- (no CPE)range: < 3.13.14
- (no CPE)range: < 3.13.14
- (no CPE)range: < 3.14.5-1.el9_8
- (no CPE)range: < 3.14.5-1.el9_8
- (no CPE)range: < 3.14.5-1.el9_8
- (no CPE)range: < 3.14.5-1.el9_8
- (no CPE)range: < 3.14.5-1.el9_8
- (no CPE)range: < 3.14.5-1.el9_8
- (no CPE)range: < 3.14.5-1.el9_8
- (no CPE)range: < 3.14.5-1.el9_8
- (no CPE)range: < 3.14.5-1.el9_8
- (no CPE)range: < 3.14.5-1.el9_8
- (no CPE)range: < 3.14.5-1.el9_8
- (no CPE)range: < 3.14.5-1.el9_8
- (no CPE)range: < 3.14.5-1.el9_8
- (no CPE)range: < 3.14.5-1.el9_8
- (no CPE)range: < 3.13.14-160000.1.1
- (no CPE)range: < 3.10.20-6.1
- (no CPE)range: < 3.11.15-6.1
- (no CPE)range: < 3.12.13-6.1
- (no CPE)range: < 3.13.14-160000.1.1
- (no CPE)range: < 3.13.13-2.1
- (no CPE)range: < 3.13.14-160000.1.1
- (no CPE)range: < 3.13.14-160000.1.1
- (no CPE)range: < 3.13.14-160000.1.1
- (no CPE)range: < 3.13.14-160000.1.1
- (no CPE)range: < 3.14.6-1.1
- (no CPE)range: < 3.15.0~a8-3.1
- (no CPE)range: < 2.7.18-150000.120.1
- (no CPE)range: < 2.7.18-150000.120.1
- (no CPE)range: < 3.13.13-150700.4.50.1
- (no CPE)range: < 3.13.13-150700.4.50.1

Patches

Vulnerability mechanics

References

github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76cnvdPatch
github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104nvdPatch
github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8nvdPatch
github.com/python/cpython/pull/148848nvdIssue TrackingPatch
github.com/python/cpython/issues/90309nvdExploitIssue Tracking
mail.python.org/archives/list/[email protected]/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/nvdMailing ListVendor Advisory

News mentions

No linked articles in our index yet.

Severity

MediumCVSS v3.1

6.1/ 10

CVSS v42.1

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

Probability of exploitation in the next 30 days.

0.23%

VYPR risk score

Composite of severity, exploitation, and reach.

0.33medium

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000

Weaknesses

CWE-116
Improper Encoding or Escaping of Output
CWE-150
Improper Neutralization of Escape, Meta, or Control Sequences

CVE ID

CVE-2026-6019

Credits

O(
oolongeya (https://github.com/komi22)
reporter
SL
Seth Larson (https://github.com/sethmlarson)
coordinator