The vulnerability in Python Software Foundation's CPython involves the http.cookies.Morsel.js_output() function, which generates an inline <script> snippet. It escapes only the double quote character for JavaScript string context but does not neutralize the HTML parser-sensitive sequence </script>. This improper neutralization (CWE-150) could allow injection of unintended script termination sequences within the script element. The suggested mitigation is to base64-encode the cookie value to prevent exploitation through crafted cookie content. There is no vendor advisory indicating an official fix or patch at this time.

The impact is limited due to the low CVSS score (2.1) and the nature of the vulnerability, which involves improper neutralization of escape sequences in a specific function generating inline scripts. This could potentially allow an attacker with high privileges (as indicated by the CVSS vector requiring high privileges) to influence script content via cookie values, but the overall risk is low. No known exploits are reported in the wild.

No official patch or remediation level has been provided by the vendor. The recommended mitigation is to base64-encode cookie values before using them in the js_output() method to prevent injection of the </script> sequence. Users should monitor the Python Software Foundation advisories for any forthcoming official fixes.