Python: BaseCookie.js_output() does not neutralize embedded characters (CVE-2026-6019)
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
AI Analysis
Technical Summary
CVE-2026-6019 is a vulnerability in the Python http.cookies module where the Morsel.js_output() function does not correctly neutralize the </script> HTML sequence. This improper neutralization can enable Cross-Site Scripting (XSS) attacks, allowing remote attackers to inject malicious JavaScript into web pages. The vulnerability affects Red Hat Hardened Images RPMs containing Python 3.11 and related packages. Red Hat has released updated RPM packages (e.g., python3.11-3.11.15-4.3.hum1) as part of a security advisory (RHSA-2026:33885). However, mitigation options are limited or do not meet Red Hat's standards for ease of use and applicability. The vulnerability is linked to CWE-79 (Improper Neutralization of Input During Web Page Generation).
Potential Impact
Successful exploitation of this vulnerability could allow attackers to perform Cross-Site Scripting (XSS) attacks, leading to disclosure of sensitive information such as cookies, session tokens, or other private data. It may also enable execution of arbitrary code within the context of the victim's browser, potentially compromising user accounts or enabling further attacks. The impact includes confidentiality and integrity breaches but does not affect availability. Red Hat rates this vulnerability as medium severity.
Mitigation Recommendations
Red Hat has not provided an official fix that meets their criteria for deployment and stability at this time. Users are advised to monitor Red Hat advisories for updates. No effective mitigation is currently available that is easy to deploy or broadly applicable. Customers with a Red Hat Technical Account Manager (TAM) can seek direct guidance. Applying the updated RPM packages when they become available is recommended once Red Hat releases a suitable fix.
Python: BaseCookie.js_output() does not neutralize embedded characters (CVE-2026-6019)
Description
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-6019 is a vulnerability in the Python http.cookies module where the Morsel.js_output() function does not correctly neutralize the </script> HTML sequence. This improper neutralization can enable Cross-Site Scripting (XSS) attacks, allowing remote attackers to inject malicious JavaScript into web pages. The vulnerability affects Red Hat Hardened Images RPMs containing Python 3.11 and related packages. Red Hat has released updated RPM packages (e.g., python3.11-3.11.15-4.3.hum1) as part of a security advisory (RHSA-2026:33885). However, mitigation options are limited or do not meet Red Hat's standards for ease of use and applicability. The vulnerability is linked to CWE-79 (Improper Neutralization of Input During Web Page Generation).
Potential Impact
Successful exploitation of this vulnerability could allow attackers to perform Cross-Site Scripting (XSS) attacks, leading to disclosure of sensitive information such as cookies, session tokens, or other private data. It may also enable execution of arbitrary code within the context of the victim's browser, potentially compromising user accounts or enabling further attacks. The impact includes confidentiality and integrity breaches but does not affect availability. Red Hat rates this vulnerability as medium severity.
Mitigation Recommendations
Red Hat has not provided an official fix that meets their criteria for deployment and stability at this time. Users are advised to monitor Red Hat advisories for updates. No effective mitigation is currently available that is easy to deploy or broadly applicable. Customers with a Red Hat Technical Account Manager (TAM) can seek direct guidance. Applying the updated RPM packages when they become available is recommended once Red Hat releases a suitable fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:22952
- Cve Count
- 1
- State
- PUBLISHED
Threat ID: 6a2bea10e617e2d8345887a9
Added to database: 06/12/2026, 11:14:24 UTC
Last enriched: 08/16/2026, 17:57:50 UTC
Last updated: 09/14/2026, 22:01:36 UTC
Views: 84
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.