Cross-Site Scripting in Python http.cookies.Morsel.js_output

Executive Summary

The vulnerability in CVE-2026-6019 exists in Python's http.cookies.Morsel.js_output() method, which generates an inline <script> snippet embedding cookie values for JavaScript use.

The method only escapes double quotes (") within the JavaScript string context but does not neutralize the HTML parser-sensitive sequence </script>. This allows an attacker to inject malicious HTML or JavaScript by prematurely terminating the script element.

The issue is mitigated by base64-encoding the cookie value before embedding it in the JavaScript, preventing malicious sequences from breaking out of the script context.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the `http.cookies.Morsel.js_output()` method embedding cookie values directly into JavaScript without proper encoding, allowing HTML injection via sequences like </script>.

To detect this vulnerability on your system or network, you can inspect HTTP responses that include inline JavaScript snippets generated by this method and check if cookie values are embedded without Base64 encoding.

A practical approach is to capture HTTP traffic and search for inline <script> elements containing cookie values that include suspicious sequences such as </script> or unescaped characters.

• Use a network capture tool like tcpdump or Wireshark to capture HTTP responses.
• Run a command to filter HTTP responses containing inline scripts with cookie values, for example using grep:
• tcpdump -A -s 0 'tcp port 80' | grep -i '<script' -A 5 | grep -E '</script>|"'
• Alternatively, if you have access to the Python environment, review the source code or logs to verify if the `js_output()` method is used without Base64 encoding.

Since the fix involves Base64 encoding cookie values before embedding, detecting unencoded cookie values in inline scripts is a key indicator of vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to cross-site scripting (XSS) attacks by allowing an attacker to inject malicious scripts into web pages through cookie values.

Such XSS attacks can compromise user data, hijack user sessions, or perform unauthorized actions on behalf of the user.

However, the vulnerability is considered low severity and requires specific conditions to be exploitable.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how CVE-2026-6019 affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should ensure that cookie values embedded in JavaScript are base64-encoded before insertion. This prevents malicious sequences like </script> from breaking out of the script context and causing HTML injection or cross-site scripting (XSS) attacks.

Specifically, update to the fixed version of Python where the http.cookies.Morsel.js_output() method has been modified to base64-encode cookie values. This fix was merged on April 22, 2026, and backported automatically to Python versions 3.13 and 3.14.

If you are using affected Python versions prior to these fixes, consider applying the patch from the official Python repository or upgrading to a patched version to prevent exploitation.

Useful 0 Not Useful 0