CVE-2026-6019

Medium

Advisory

Published 22 Apr 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.1; base score, highest
EPSS: 0.002; 14th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 554; of 17,787 indexed, latest versions
Container images: 537; deployed by those charts
Fix available: 13 of 16; affected packages

BaseCookie.js_output() does not neutralize embedded characters

Carried by container images the latest versions of 554 of 17,787 indexed charts deploy, on 537 images.

Affected package	Affected versions	Fixed in	Images
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 more	3.11.0~rc1-1~22.04.1+esm2	181
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	3.8.10-0ubuntu1~20.04.18+esm7	100
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+14 more	3.10.12-1~22.04.16	71
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3+9 more	3.12.3-1ubuntu0.15	49
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	3.6.9-1~18.04ubuntu1.13+esm10	44
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+9 more	2.7.6-8ubuntu0.6+esm30, 2.7.12-1ubuntu0~16.04.18+esm22, 2.7.17-1~18.04ubuntu1.13+esm15, 2.7.18-13ubuntu1.5+esm9	43
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	3.5.2-2ubuntu0~16.04.13+esm25	25
python3.13deb	3.13.5-2, 3.13.5-2+e30, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u2, 3.13.5-2+e36	23
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm21	7
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.13.14	3
python3.14deb	3.14.4-1	3.14.4-1ubuntu0.1	2
python3rpm	3.12.9-13.azl3	no fix listed	1
python-3.12apk	3.12.0-r1, 3.12.9-r1, 3.12.14-r2, 3.12.14-r6	no fix listed	8
python-3.14apk	3.14.2-r2, 3.14.4-r2	3.14.4-r4	5
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.13-r3	3
python-3.11apk	3.11.16-r5	no fix listed	1

OSV records: BIT-python-2026-6019 DEBIAN-CVE-2026-6019 UBUNTU-CVE-2026-6019 CGA-2rxc-qq2g-w4hf CGA-477g-5pph-75mj CGA-4q3r-438p-rwv3 CGA-6rw5-pv82-g8jw AZL-84728 ECHO-1e4c-228c-95ee
Also known as: BIT-libpython-2026-6019, BIT-python-min-2026-6019, CGA-g7j7-w4vj-6cfx, CGA-hjp9-xq8m-3jr3, CGA-qpp8-2qh9-qw2x, CGA-qxmw-675j-q4q2, PSF-2026-21, USN-8509-1, USN-8744-1

Charts affected

554 by stars

Chart

Latest

Affected images

Radar Score

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-6019.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	python3.11@3.11.2-6+deb12u8	no fix listed

Open the chart page →

8,824

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-6019.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

15,287

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-6019.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

9,296

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-6019.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

14,172

Container images carrying it

537 by charts deploying them

A fixed version is listed for 13 of the 16 affected packages.

Container image	Digest	Package	Fixed in	Used by
socialmediamacroscope/preprocessing :0.1.3	ca863306314b	python3.11@3.11.2-6	no fix listed	1
socialmediamacroscope/topic_modeling :0.1.3	fa490acac2f8	python3.11@3.11.2-6	no fix listed	1
someblackmagic/k8s-testing-multitool :v0.1.0	6eca64b6b440	python3.8@3.8.10-0ubuntu1~20.04.4	3.8.10-0ubuntu1~20.04.18+esm7	1
sonroyaalmerol/docker-sogo :5.12.4	3f60f3abe990	python3.13@3.13.5-2	3.13.5-2+deb13u2	1
speckle/speckle-monitor-deployment :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	2faf1508c1d3	python3.11@3.11.2-6	no fix listed	1
speckle/speckle-monitor-deployment :2.20.2-branch.testing4.134160-9fad4b2	3c8fbe855665	python3.11@3.11.2-6	no fix listed	1
speckle/speckle-monitor-deployment :2.20.6-branch.testing1.154030-9b09114	738c77eb6f97	python3.11@3.11.2-6	no fix listed	1
speckle/speckle-monitor-deployment :2.18.12-branch.testing3.88744-f55b341	81335b40696a	python3.11@3.11.2-6	no fix listed	1
speckle/speckle-monitor-deployment :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	b696ac5022ab	python3.11@3.11.2-6	no fix listed	1
speckle/speckle-monitor-deployment :2.21.3-branch.testing5.219631-2153bef	cf72ad0f25fb	python3.11@3.11.2-6	no fix listed	1
speckle/speckle-monitor-deployment :2.18.11-branch.testing2.88634-335d469	d6790a97ad47	python3.11@3.11.2-6	no fix listed	1
speckle/speckle-monitor-deployment :2.17.14-branch.testing.72707.921a5f8	ff1641ac3f1b	python3.11@3.11.2-6	no fix listed	1
stackstorm/st2actionrunner :3.8	88235ba70cad	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2api :3.8	6f56d239d280	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2auth :3.8	33ecfda16608	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2garbagecollector :3.8	4e3f8c7ca52d	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2notifier :3.8	f190a6212195	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2rulesengine :3.8	259503496ff9	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2scheduler :3.8	b1de2055c362	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2sensorcontainer :3.8	b1a338f64773	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2stream :3.8	1c8904a3bf67	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2timersengine :3.8	1bf35bfaf00c	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2workflowengine :3.8	19fdfffdbba8	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stashapp/stash :latest	24dbd7607174	python3.8@3.8.5-1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7	1
statcan/ckan :2.9	3921305425b8	python3.8@3.8.5-1~20.04.3	3.8.10-0ubuntu1~20.04.18+esm7	1
streamnative/apache-pulsar-grafana-dashboard-k8s :0.0.16	11bceacec8fb	python3.8@3.8.5-1~20.04.3	3.8.10-0ubuntu1~20.04.18+esm7	1
substratusai/verba :v0.4.0-baseURL2	61695be635eb	python3.11@3.11.2-6	no fix listed	1
supabase/realtime :v2.102.3	aa1c92c0cf32	python3.11@3.11.2-6+deb12u7	no fix listed	1
supabase/studio :20241021-9f9b083	26d8070c55e9	python3.11@3.11.2-6+deb12u3	no fix listed	1
supabase/studio :2026.08.03-sha-022b374	606aca9fdaa7	python3.11@3.11.2-6+deb12u8	no fix listed	1
supabase/studio :latest	94a2a9d2906e	python3.11@3.11.2-6+deb12u8	no fix listed	1
svtechnmaa/svtech_debuger :v1.0.3	a934ffd63d25	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16	1
svtechnmaa/svtech_rundeck :v1.2.2	6e368ace0977	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
sysnet4admin/colosseum-cms :log	e74b43c7f492	python3.11@3.11.2-6+deb12u6	no fix listed	1
sysnet4admin/colosseum-prm :log	5802bfcd7fed	python3.11@3.11.2-6+deb12u6	no fix listed	1
teknas09/bird-pod :latest	12a1fa85c4aa	python3.11@3.11.2-6	no fix listed	1
tensorflow/tensorflow :1.6.0-devel	1e3172090703	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1
theradius/loggia :0.4	63ba348546ec	python3.11@3.11.2-6	no fix listed	1
thongngo3301/stakefish :latest	a341af5976e3	python3.11@3.11.2-6	no fix listed	1
timescale/timescaledb-ha :pg15-latest	a8e3322e1cf9	python3.10@3.10.6-1~22.04.2ubuntu1	3.10.12-1~22.04.16	1
timescale/timescaledb-ha :pg14.6-ts2.9.1-p1	cdb9ae118899	python3.10@3.10.6-1~22.04.2	3.10.12-1~22.04.16	1
timescale/timescaledb-ha :pg17.2-ts2.18.2	e8d0a9cc3db5	python3.10@3.10.12-1~22.04.9	3.10.12-1~22.04.16	1
timescale/timescaledb-ha :pg14-ts2.6-latest	ed719c0cd19d	python3.10@3.10.4-3	3.10.12-1~22.04.16	1
timothyclarke/wptagent :2018-01-23	22c41e5ca7e2	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1
tinymediamanager/tinymediamanager :5.3.2	2b34dc85099e	python3.13@3.13.5-2	3.13.5-2+deb13u2	1
tpdock/freeradius :2.2.9	3da600c95a49	python2.7@2.7.12-1ubuntu0~16.04.2 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1
treskon/portrait-web-setup :DEV-latest	a475d80e4ecf	python3.11@3.11.2-6+deb12u5	no fix listed	1
trinodb/trino :405	ee80ab5eeab2	python3.10@3.10.6-1~22.04.2	3.10.12-1~22.04.16	1
trueosiris/vrising :latest	9356f98ad561	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.16	1
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16	1