CVE-2026-6019

Medium

Advisory

Published 22 Apr 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.1; base score, highest
EPSS: 0.002; 14th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 554; of 17,787 indexed, latest versions
Container images: 537; deployed by those charts
Fix available: 13 of 16; affected packages

BaseCookie.js_output() does not neutralize embedded characters

Carried by container images the latest versions of 554 of 17,787 indexed charts deploy, on 537 images.

Affected package	Affected versions	Fixed in	Images
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 more	3.11.0~rc1-1~22.04.1+esm2	181
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	3.8.10-0ubuntu1~20.04.18+esm7	100
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+14 more	3.10.12-1~22.04.16	71
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3+9 more	3.12.3-1ubuntu0.15	49
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	3.6.9-1~18.04ubuntu1.13+esm10	44
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+9 more	2.7.6-8ubuntu0.6+esm30, 2.7.12-1ubuntu0~16.04.18+esm22, 2.7.17-1~18.04ubuntu1.13+esm15, 2.7.18-13ubuntu1.5+esm9	43
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	3.5.2-2ubuntu0~16.04.13+esm25	25
python3.13deb	3.13.5-2, 3.13.5-2+e30, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u2, 3.13.5-2+e36	23
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm21	7
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.13.14	3
python3.14deb	3.14.4-1	3.14.4-1ubuntu0.1	2
python3rpm	3.12.9-13.azl3	no fix listed	1
python-3.12apk	3.12.0-r1, 3.12.9-r1, 3.12.14-r2, 3.12.14-r6	no fix listed	8
python-3.14apk	3.14.2-r2, 3.14.4-r2	3.14.4-r4	5
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.13-r3	3
python-3.11apk	3.11.16-r5	no fix listed	1

OSV records: BIT-python-2026-6019 DEBIAN-CVE-2026-6019 UBUNTU-CVE-2026-6019 CGA-2rxc-qq2g-w4hf CGA-477g-5pph-75mj CGA-4q3r-438p-rwv3 CGA-6rw5-pv82-g8jw AZL-84728 ECHO-1e4c-228c-95ee
Also known as: BIT-libpython-2026-6019, BIT-python-min-2026-6019, CGA-g7j7-w4vj-6cfx, CGA-hjp9-xq8m-3jr3, CGA-qpp8-2qh9-qw2x, CGA-qxmw-675j-q4q2, PSF-2026-21, USN-8509-1, USN-8744-1

Charts affected

554 by stars

Chart

Latest

Affected images

Radar Score

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-6019.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	python3.11@3.11.2-6+deb12u8	no fix listed

Open the chart page →

8,824

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-6019.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

15,287

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-6019.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

9,296

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-6019.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

14,172

Container images carrying it

537 by charts deploying them

A fixed version is listed for 13 of the 16 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/grycap/im :latest	06a16d4f279f	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15	1
ghcr.io/haveagitgat/tdarr :2.00.18.2	3fbe4c29d14c	python3.8@3.8.10-0ubuntu1~20.04.4	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	python3.13@3.13.5-2	3.13.5-2+deb13u2	1
ghcr.io/invergent-ai/surogate-hub :latest	6d4106724d56	python3.11@3.11.2-6+deb12u7	no fix listed	1
ghcr.io/jespernohr/dayz-dedicated-server :0.1.1	ec01d3ac7887	python3.12@3.12.3-1ubuntu0.2	3.12.3-1ubuntu0.15	1
ghcr.io/jfwenisch/discord-experiencebot :latest	b52ff07f9f0c	python3.6@3.6.9-1~18.04ubuntu1.12	3.6.9-1~18.04ubuntu1.13+esm10	1
ghcr.io/jfwenisch/steamcmd-manager :v0.4.5	dab685e668d9	python3.12@3.12.3-1ubuntu0.3	3.12.3-1ubuntu0.15	1
ghcr.io/jfwenisch/webtools :v0.1.4	4569cae83c70	python3.12@3.12.3-1ubuntu0.3	3.12.3-1ubuntu0.15	1
ghcr.io/jr0dd/puppeteer :v13.3.2	6047599cd78e	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/bazarr :v1.0.3	fdb5501cdfb9	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	python3.8@3.8.10-0ubuntu1~20.04	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/nzbget :v21.1	e5571acd10ce	python3.10@3.10.4-3ubuntu0.1	3.10.12-1~22.04.16	1
ghcr.io/k8s-at-home/nzbhydra2 :v3.14.2	ef3670f7e0a8	python3.8@3.8.5-1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/prowlarr :v0.3.0.1710	c863aa9875fa	python3.8@3.8.10-0ubuntu1~20.04.4	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/qbittorrent :v4.4.2	61deadd1ec78	python3.8@3.8.10-0ubuntu1~20.04.4	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/sabnzbd :v3.3.1	c2d6e775db5a	python3.8@3.8.5-1~20.04.3	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/tautulli :v2.7.7	4ea617c30397	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/transmission :v3.00	6011182e3946	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/xteve :v2.2.0.200	292b3614670f	python3.8@3.8.10-0ubuntu1~20.04.4	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/kamu-data/kamu-api-server :0.89.0	4ed7a896dd2b	python3.8@3.8.10-0ubuntu1~20.04.18	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/kore3lab/kore-board.terminal :v0.5.5	f52e66eff50b	python3.6@3.6.9-1~18.04ubuntu1.9	3.6.9-1~18.04ubuntu1.13+esm10	1
ghcr.io/kubeflow/spark-operator/controller :2.2.1	865ff4da5686	python3.8@3.8.10-0ubuntu1~20.04.18	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/kubiyabot/agent-manager :v0.4.13	757bdd779345	python3.13@3.13.5-2	3.13.5-2+deb13u2	1
ghcr.io/kvaps/kubefarm-ltsp :v0.13.4	24efef013a53	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/libreconnect/ferriscompany :0.1.0-rc6	ed86db9f0efe	python3.11@3.11.2-6+deb12u3	no fix listed	1
ghcr.io/lloesche/valheim-server :latest	20fde516ce31	python3.13@3.13.5-2	3.13.5-2+deb13u2	1
ghcr.io/maastrichtu-ids/rstudio :latest	981aa4c109e1	python3.12@3.12.3-1ubuntu0.5	3.12.3-1ubuntu0.15	1
ghcr.io/mcwarman/backstage-sample-app/backend :main	07aba09a594f	python3.11@3.11.2-6+deb12u6	no fix listed	1
ghcr.io/middleware-labs/mw-kube-agent :1.12.0	9c7bc0f9bb35	python3.12@3.12.3-1ubuntu0.3	3.12.3-1ubuntu0.15	1
ghcr.io/music-assistant/server :2.7.5	3522e8a7a8f0	python3.11@3.11.2-6+deb12u6	no fix listed	1
ghcr.io/music-assistant/server :2.9.9	50666a6f8d7f	python3.11@3.11.2-6+deb12u7	no fix listed	1
ghcr.io/music-assistant/server :2.8.7	eef3ee7810d0	python3.11@3.11.2-6+deb12u6	no fix listed	1
ghcr.io/nefelim4ag/pingdom-operator :0.0.15	f8c7afdcf439	python3.11@3.11.2-6+deb12u2	no fix listed	1
ghcr.io/openclaw/openclaw :2026.6.10	af7ea052cf21	python3.11@3.11.2-6+deb12u7	no fix listed	1
ghcr.io/openclaw/openclaw :2026.5.22	dcfd14877740	python3.11@3.11.2-6+deb12u7	no fix listed	1
ghcr.io/opencost/opencost-parquet-exporter :v0.2.1	ce85ef0ce665	python3.11@3.11.2-6+deb12u5	no fix listed	1
ghcr.io/oznu/homebridge :2022-07-08	ff2af53897e7	python3.8@3.8.10-0ubuntu1~20.04.4	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/quenchworks/images/airflow	3f8281e23704	python-3.12@3.12.14-r2	no fix listed	1
ghcr.io/quenchworks/images/mlflow	b6e937696995	python-3.12@3.12.14-r2	no fix listed	1
ghcr.io/samr037/node-debug-dashboard :0.3.0	c79b2e64a211	python3.11@3.11.2-6+deb12u8	no fix listed	1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	python3.11@3.11.2-6+deb12u5	no fix listed	1
ghcr.io/smarter-project/audio-client :v3.1.2	3c8375dc5487	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/smarter-project/gstreamer :v1.0.2	5ecb16015aa8	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/smarter-project/image-detector :v2.5.3	1dcca70c6446	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/stirling-tools/stirling-pdf :2.14.3	3b3670fce70b	python3.12@3.12.3-1ubuntu0.12	3.12.3-1ubuntu0.15	1
ghcr.io/streamingfast/firehose-core :v1.12.3	91fca773a63f	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15	1
ghcr.io/streamingfast/firehose-ethereum :v2.12.4	89969b78fb07	python3.12@3.12.3-1ubuntu0.7	3.12.3-1ubuntu0.15	1
ghcr.io/streamingfast/firehose-ethereum :v2.14.3	bf816072380e	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15	1
ghcr.io/streamingfast/firehose-ethereum :v2.12.4-geth	d7bdfa7b41da	python3.12@3.12.3-1ubuntu0.7	3.12.3-1ubuntu0.15	1
ghcr.io/streamingfast/go-ethereum :geth-v1.16.9-fh3.0	8e3cb38953a3	python3.12@3.12.3-1ubuntu0.10	3.12.3-1ubuntu0.15	1