{"action":"Upgrade python to 3.13.14 or later.","affected":[{"fixed":"3.13.14","introduced":"0"}],"component":"python","cve_ids":["CVE-2026-6019"],"ecosystem":"python","exploited":false,"fixed_versions":["3.13.14"],"id":"tcs_01M5JTNWFGBCZTV985XHJYHSMS","modified_at":"2026-04-29T15:31:09Z","published_at":"2026-04-22T19:28:08Z","references":["https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2026-21.json","https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/","https://www.cve.org/CVERecord?id=CVE-2026-6019"],"severity":{"label":"low","score":2.1},"sources":[{"source":"python-runtime","source_id":"PSF-2026-21","url":"https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2026-21.json"}],"summary":"BaseCookie.js_output() does not neutralize embedded characters"}