inside the gene", "datePublished": "2026-04-22T20:16:42+00:00", "dateModified": "2026-04-22T21:23:52+00:00", "author": { "@type": "Organization", "name": "National Vulnerability Database" }, "publisher": { "@type": "Organization", "name": "CVEInfo.com", "logo": { "@type": "ImageObject", "url": "https://cveinfo.com/logo.png", "width": 600, "height": 60 } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://cveinfo.com/detail.php?id=CVE-2026-6019" } }
Back to CVE List

CVE-2026-6019

Vulnerability Description

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

Vulnerability Details

Published Date
Last Modified
CWE ID
CWE-150
Source
NVD

External References

Discussion (0)

Add Comment

No comments yet. Be the first!