CPython EUVD-2026-25079

Exploitation requires the following specific conditions: (1) The attacker must have high privilege level (PR:H) to set or manipulate cookie values on the target system - this typically means system-level access, compromised server process, or administrative capability; (2) The victim application must explicitly call http.cookies.Morsel.js_output() to serialize cookies as inline JavaScript, a non-default and relatively uncommon pattern in modern web applications that typically use JSON or HTTP-only cookies; (3) The generated script output must be inserted into an HTML page without additional escaping, allowing the HTML parser to interpret the injected </script> sequence; (4) The victim must view or interact with the page containing the injected script in a browser that processes inline scripts. The vulnerability does NOT affect standard cookie handling via Set-Cookie headers or HTTP-only cookie flags. Default configurations of CPython applications are protected if they do not explicitly use js_output() for cookie serialization in user-facing content.

Despite the low CVSS score of 2.1, this vulnerability presents a subtle but real risk requiring contextual assessment. The CVSS vector shows attack vector network (AV:N) and low attack complexity (AC:L), but critical limiting factors severely constrain real-world exploitation: the attacker requires high privileges (PR:H), attack timing is unpredictable (AT:P), and impact is limited to confidentiality and integrity of the target (VC:L, VI:L, no availability impact). SSVC framework confirms 'Exploitation: none' (no active exploitation), 'Automatable: no' (requires manual crafting and high privileges), and 'Technical Impact: partial' (limited scope). The low CVSS reflects these constraints accurately - this is not a high-impact vulnerability despite network accessibility. Real-world risk is low because exploitation requires an attacker with high system privileges to craft and inject malicious cookies, a scenario unlikely in typical threat models. The vulnerability is primarily a defense-in-depth concern: improper escaping in a library function that developers might assume is safe for HTML output. SSVC and CVSS signals align, indicating a lower-priority remediation compared to network-accessible pre-authentication vulnerabilities.

An attacker with high system privileges (e.g., a compromised server process or malicious system administrator) crafts a Python cookie with a value containing </script> followed by arbitrary JavaScript (e.g., cookie_value = 'test</script><script>alert(1)</script>'). When http.cookies.Morsel.js_output() processes this cookie, it generates an HTML snippet such as <script>var mycookie="test</script><script>alert(1)</script>";</script>. The HTML parser interprets </script> as the end of the first script element and parses the injected script tag as new HTML content, executing the attacker's JavaScript in the document context.