---
id: CVE-2026-6019
title: >-
  http.cookies.Morsel.js_output() returns an inline <script> snippet and only
  escapes " for JavaScript string context
summary: >-
  http.cookies.Morsel.js_output() returns an inline <script> snippet and only
  escapes " for JavaScript string context. It does not neutralize the HTML
  parser-sensitive sequence </script> inside the generated script element.
  Mitigation base…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-150
  - CWE-116
vendor: python
product: python
affected:
  - python < 3.13.14
  - 'python >= 3.14.0, <= 3.14.4'
  - python = 3.15.0
patched:
  - python 3.13.14
published: '2026-04-22'
updated: '2026-07-27'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6019'
references:
  - url: >-
      https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8
    label: cna@python.org
  - url: 'https://github.com/python/cpython/issues/90309'
    label: cna@python.org
  - url: 'https://github.com/python/cpython/pull/148848'
    label: cna@python.org
  - url: >-
      https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/
    label: cna@python.org
tags:
  - nvd
epss: 0.00211
epssPercentile: 0.11637
ingestedAt: '2026-07-27T18:22:57.927Z'
---

## Overview

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

## Affected

- `python < 3.13.14`
- `python >= 3.14.0, <= 3.14.4`
- `python = 3.15.0`

## Remediation

Upgrade past the affected range:

- `python 3.13.14`