ZeroDay Findings
Sign inSign up

Findings

CVE-2026-6019

http.cookies.Morsel.js_output() returns an inline snippet and only escapes " for JavaScript string context.

Published Apr 22, 2026 · updated Jul 27, 2026 · python python

http.cookies.Morsel.js_output() returns an inline snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 22, 2026 · NIST NVD

    Detected

    http.cookies.Morsel.js_output() returns an inline snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

  2. Jul 27, 2026 · NIST NVD

    Updated

    http.cookies.Morsel.js_output() returns an inline snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

Affected

  • cpe python/pythonversion unspecified
  • cpe python/python3.15.0

Sources

  • CVE.orgVulnerability recordCVE-2026-6019

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-6019

    http.cookies.Morsel.js_output() returns an inline snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence inside the generated script element. Mitigation base64-encodes the cookie value to disallow esc

    nvd.nist.gov

References