Start your free trial today.

Protect your organization with cutting-edge cybersecurity solutions designed for resilience and efficiency. Secure your digital assets with confidence.

Your Shield Against Threats

Unleash the Power of Cybersecurity

Boost Your Security, Enhance Your Business

We solve Your Cyber Challenges

Quick Links

Resources

Deepaegis Portals

Vulnerability Advisory : BaseCookie.js_output() does not neutralize embedded characters with LOW Attack Complexity

Summary

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

Impact Assessment

Timeline

Published

April 22, 2026

Last Modified

April 22, 2026

Related Advisories

inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.","datePublished":"2026-04-22T20:16:42.617Z","dateModified":"2026-04-22T21:23:52.620Z","author":{"@type":"Organization","name":"Deepaegis","url":"https://deepaegis?.io"},"publisher":{"@type":"Organization","name":"Deepaegis","logo":{"@type":"ImageObject","url":"https://deepaegis?.io/logo?.png"}},"mainEntityOfPage":{"@type":"WebPage","@id":"https://deepaegis?.io/vulnerability-advisories/basecookiejsoutput-does-not-neutralize-embedded-characters"},"keywords":"CVE-2026-6019, , Python Software Foundation, CPython"}