TI-2026-05281 CVE-2026-6019 · GHSA-2755-2mm4-rm5c
BaseCookie.js_output() does not neutralize embedded characters
Priority LOW 11
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context.
RHSA-2026:22952
Red Hat Hardened Images RPMs bug fix and enhancement update
Released 2026-06-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Hardened Images python-unversioned-command-3.14.5-2.hum1@noarch@public-hummingbird-aarch64-rpms, python-unversioned-command-3.14.5-2.hum1@noarch@public-hummingbird-x86_64-rpms, python3-3.14.5-2.hum1@aarch64 +28