Threats tagged 'brew-jupyterlab-ghsa-wwv5-g3v4-889x'

CVE-2026-91991 is a vulnerability in Tornado's set_cookie method where an incomplete fix for a previous cookie attribute injection flaw (CVE-2026-35536) allows injection via capitalized keyword arguments. The validation loop only checks lowercase keys, while capitalized keys in the deprecated kwargs path bypass validation, enabling injection of cookie attributes such as Secure, HttpOnly, SameSite, Domain, and Path. This flaw affects Tornado versions from 4.5.6 up to but not including 4.6.3. A fix is available in version 4.6.3.