CVE-2026-6019

Katalog CVE

CVSS 6.1 · Medium EPSS 0,21%

Kerentanan Improper Neutralization of Escape, Meta, or Control Sequences pada python. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

Rincian

Terbit di NVD

22 April 2026

Terakhir diubah

27 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/ mailing list · advisory vendor
• https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c patch
• https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104 patch
• https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8 patch
• https://github.com/python/cpython/pull/148848 issue tracking · patch
• https://github.com/python/cpython/issues/90309 exploit · issue tracking