The http.cookies.Morsel.js_output function emits an inline <script> element, escaping only the double‑quote character for JavaScript string contexts. It fails to neutralize the HTML‑parser sensitive sequence </script> that could appear inside a cookie value. Because the value is inserted directly into the script tag, an attacker who can manipulate the cookie could close the script prematurely and inject arbitrary JavaScript, resulting in cross‑site scripting. The weakness is classified as CWE‑79. The CVSS score of 2.1 indicates a low severity, but the vulnerability remains exploitable when the vulnerable code is used.

All CPython implementations provided by the Python Software Foundation that employ the http.cookies.Morsel.js_output method are affected. The CVE record does not specify exact affected releases, so any CPython version prior to the commit that base64‑encodes cookie values for js_output is potentially vulnerable. Applications that render cookie values via js_output should verify that the patched code is present.

The EPSS score is less than 1 %, and the vulnerability is not listed in CISA’s KEV catalog, indicating that no active exploitation is currently reported. Nonetheless, if an attacker can control the cookie value, they can inject malicious scripts into the page, compromising confidentiality and integrity of user data. The risk is mitigated by applying the patched CPython release or by ensuring that cookie values are properly sanitized before being embedded in a script element.