{"id":"CVE-2026-6019","aliases":[],"cve":{"records":[{"id":"CVE-2026-6019","source":"PSF","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-04-09T15:35:00.668Z","published":"2026-04-22T19:28:08.720Z","modified":"2026-11-10T12:40:32.622Z"}],"publishers":[{"name":"PSF","role":"CNA","organizationId":"28c92f92-d60d-412d-b760-e73465c3df22","modified":"2026-06-10T18:58:07.798Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-04-22T20:02:34.468Z"},{"name":"siemens-SADP","role":"ADP","organizationId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","modified":"2026-11-10T12:40:32.622Z"}],"references":[{"url":"https://github.com/python/cpython/pull/148848","tags":["patch"],"source":"PSF"},{"url":"https://github.com/python/cpython/issues/90309","tags":["issue-tracking"],"source":"PSF"},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/","tags":["vendor-advisory"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104","tags":["patch"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c","tags":["patch"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8","tags":["patch"],"source":"PSF"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","tags":[],"source":"siemens-SADP"}],"weaknesses":[{"id":"CWE-150","description":"CWE-150 Improper neutralization of escape, meta, or control sequences","source":"PSF"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-04-22T20:02:17.071906Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"BaseCookie.js_output() does not neutralize embedded characters","titleSource":"PSF","descriptionSource":"PSF","description":"http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes \" for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.","score":2.1,"severity":"low","published":"2026-04-22T19:28:08.720Z","modified":"2026-11-10T12:40:32.622Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Python Software Foundation","name":"CPython","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.13.14","versionType":"python"},{"version":"3.14.0a1","status":"affected","lessThan":"3.14.5rc1","versionType":"python"},{"version":"3.15.0a1","status":"affected","lessThan":"3.15.0b1","versionType":"python"}],"defaultStatus":"unaffected","cpes":[],"source":"PSF","url":"https://www.cve.org/CVERecord?id=CVE-2026-6019"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","platforms":[],"versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-6019"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","platforms":[],"versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-6019"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","platforms":[],"versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-6019"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","platforms":[],"versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-6019"},{"vendor":"Siemens","name":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","platforms":[],"versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-6019"}],"remediation":[],"references":["https://github.com/python/cpython/pull/148848","https://github.com/python/cpython/issues/90309","https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/","https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104","https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c","https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"sources":[{"name":"CVE","id":"CVE-2026-6019","modified":"2026-11-10T12:40:32.622Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-6019"}],"assessments":[{"source":"PSF","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":2.1}],"sourceAffected":[],"observedAt":"2026-11-10T12:49:16.615Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:15:33.603Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"CPython versions less than 3.13.14, 3.14.0a1 to less than 3.14.5rc1, and 3.15.0a1 to less than 3.15.0b1 have a weakness where BaseCookie.js_output() does not neutralize embedded characters. The http.cookies.Morsel.js_output() function returns an inline script snippet and only escapes for JavaScript string context. This may allow HTML parser-sensitive sequences to be injected.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T15:16:34.534Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-6019"}]}}