CVE-2026-6019 BaseCookie.js_output() does not neutralize embedded characters
An attacker can inject malicious scripts via cookie values due to insufficient escaping in Python's http.cookies module, leading to XSS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6019?
CVE-2026-6019 is a low-severity cross-site scripting vulnerability in Python Python, published on 22 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
Which versions are affected by CVE-2026-6019?
3 open source packages ship an affected version, including libpython, python and python-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.13.14, 3.14.5 |
python Bitnami | All versions | 3.13.14, 3.14.5 |
python-min Bitnami | All versions | 3.13.14, 3.14.5 |
Linux distribution packages (37)
python-unversioned-command Red Hat:hummingbird:1 | All versions | 0:3.14.5-2.hum1 |
python3 Red Hat:hummingbird:1 | All versions | 0:3.14.5-2.hum1 |
python3-debug Red Hat:hummingbird:1 | All versions | 0:3.14.5-2.hum1 |
python3-devel Red Hat:hummingbird:1 | All versions | 0:3.14.5-2.hum1 |
python3-idle Red Hat:hummingbird:1 | All versions | 0:3.14.5-2.hum1 |
python3-libs Red Hat:hummingbird:1 | All versions | 0:3.14.5-2.hum1 |
python3-test Red Hat:hummingbird:1 | All versions | 0:3.14.5-2.hum1 |
python3-tkinter Red Hat:hummingbird:1 | All versions | 0:3.14.5-2.hum1 |
python3.11 Red Hat:hummingbird:1 | All versions | 0:3.11.15-4.3.hum1 |
python3.11-debug Red Hat:hummingbird:1 | All versions | 0:3.11.15-4.3.hum1 |
python3.11-devel Red Hat:hummingbird:1 | All versions | 0:3.11.15-4.3.hum1 |
python3.11-idle Red Hat:hummingbird:1 | All versions | 0:3.11.15-4.3.hum1 |
python3.11-libs Red Hat:hummingbird:1 | All versions | 0:3.11.15-4.3.hum1 |
python3.11-test Red Hat:hummingbird:1 | All versions | 0:3.11.15-4.3.hum1 |
python3.11-tkinter Red Hat:hummingbird:1 | All versions | 0:3.11.15-4.3.hum1 |
python3.12 Red Hat:hummingbird:1 | All versions | 0:3.12.13-3.2.hum1 |
python3.12-debug Red Hat:hummingbird:1 | All versions | 0:3.12.13-3.2.hum1 |
python3.12-devel Red Hat:hummingbird:1 | All versions | 0:3.12.13-3.2.hum1 |
python3.12-idle Red Hat:hummingbird:1 | All versions | 0:3.12.13-3.2.hum1 |
python3.12-libs Red Hat:hummingbird:1 | All versions | 0:3.12.13-3.2.hum1 |
python3.12-test Red Hat:hummingbird:1 | All versions | 0:3.12.13-3.2.hum1 |
python3.12-tkinter Red Hat:hummingbird:1 | All versions | 0:3.12.13-3.2.hum1 |
python3.13 Red Hat:hummingbird:1 | All versions | 0:3.13.14-1.1.hum1 |
python3.13-debug Red Hat:hummingbird:1 | All versions | 0:3.13.14-1.1.hum1 |
python3.13-devel Red Hat:hummingbird:1 | All versions | 0:3.13.14-1.1.hum1 |
python3.13-freethreading Red Hat:hummingbird:1 | All versions | 0:3.13.14-1.1.hum1 |
python3.13-freethreading-debug Red Hat:hummingbird:1 | All versions | 0:3.13.14-1.1.hum1 |
python3.13-idle Red Hat:hummingbird:1 | All versions | 0:3.13.14-1.1.hum1 |
python3.13-libs Red Hat:hummingbird:1 | All versions | 0:3.13.14-1.1.hum1 |
python3.13-test Red Hat:hummingbird:1 | All versions | 0:3.13.14-1.1.hum1 |
python3.13-tkinter Red Hat:hummingbird:1 | All versions | 0:3.13.14-1.1.hum1 |
python3.14 Red Hat:hummingbird:1 | All versions | 0:3.14.5-2.hum1 |
python3.14-freethreading Red Hat:hummingbird:1 | All versions | 0:3.14.5-2.hum1 |
python3.14-freethreading-debug Red Hat:hummingbird:1 | All versions | 0:3.14.5-2.hum1 |
python3.14-freethreading-devel Red Hat:hummingbird:1 | All versions | 0:3.14.5-2.hum1 |
python3.14-freethreading-idle Red Hat:hummingbird:1 | All versions | 0:3.14.5-2.hum1 |
python3.14-freethreading-libs Red Hat:hummingbird:1 | All versions | 0:3.14.5-2.hum1 |
Products include Python Python.
How do I fix CVE-2026-6019?
Upgrade libpython to a fixed version for your release line: 3.13.14 or 3.14.5.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-6019 being exploited?
There is no known exploitation of CVE-2026-6019 in the wild and no public exploit code.
Other vulnerabilities in Python Python
Sources
Also known as AZL-109716, AZL-84728, BELL-CVE-2026-6019, BIT-libpython-2026-6019, BIT-python-2026-6019, BIT-python-min-2026-6019 and 22 more.