CVE-2026-6019 Details

A vulnerability exists in the Python http.cookies module, specifically in the BaseCookie.js_output method. This method generates a JavaScript snippet for embedding cookie values but only partially escapes characters for JavaScript string contexts. It fails to neutralize HTML-sensitive sequences, such as '</script>', which can lead to HTML injection. The issue arises because the method's output can be parsed as HTML, potentially allowing for the injection of malicious scripts. To address this, the vulnerability has been mitigated by base64-encoding the cookie values before embedding them in the JavaScript output, ensuring that any HTML-sensitive characters are properly handled.

Users should ensure that they are using a version of Python where this vulnerability has been addressed. The mitigation involves base64-encoding cookie values before embedding them in JavaScript using the js_output method.