The vulnerability CVE-2026-6019 in CPython involves improper neutralization of escape, meta, or control sequences (CWE-150) in the http.cookies.Morsel.js_output() function. This function outputs an inline JavaScript snippet embedding cookie data but only escapes double quotes, neglecting to neutralize the </script> sequence that can prematurely close the script tag in HTML. This flaw could lead to injection of unintended script content if an attacker controls the cookie value. The suggested mitigation is to base64-encode cookie values to disallow such escape sequences. No official patch or remediation level has been published by the Python Software Foundation at this time.

The impact is considered low severity with a CVSS 4.0 score of 2.1. The vulnerability could allow an attacker with high privileges (PR:H) and partial attack complexity (AC:L) to influence the JavaScript context by injecting sequences that prematurely terminate script tags. However, user interaction is not required and the vulnerability has low confidentiality and integrity impact, with no availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The known mitigation is to base64-encode cookie values before embedding them in JavaScript to prevent injection of the </script> sequence. Until an official fix is released, developers should apply this encoding as a workaround to reduce risk.