Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

microdot

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 3.7PyPIAmendedPublished

    Microdot has HTTP response splitting in Response.set_cookie()

    CVE-2026-42874 · GHSA-7wc8-wvc4-m498

    Affected
    • PyPI microdot < 2.6.1
    Fixed in
    2.6.1· Vendor fix available
    Issue
    Impact The Response.setcookie() method does not sanitize its string arguments, and in particular will not detect the presence of the \r\n sequence in them. This can be a potential source of header injection attacks. For a header injection attack through this issue to be possible, an attacker must first infiltrate the client (for example through an independent XSS attack), so that it can send malicious information that is destined to be stored in a cookie by the server on behalf of the victim. An attacker that infiltrates one client can only orchestrate a header injection attack for that client, all other clients that were not infiltrated are safe. Patches Upgrade to version 2.6.1. Workarounds Do not pass untrusted data to the Response.setcookie() method.

    Recommended action: Upgrade to 2.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →