GHSA-7wc8-wvc4-m498

Suggest an improvement
Source
https://github.com/advisories/GHSA-7wc8-wvc4-m498
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-7wc8-wvc4-m498/GHSA-7wc8-wvc4-m498.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-7wc8-wvc4-m498
Aliases
  • CVE-2026-42874
Published
2026-05-05T18:35:20Z
Modified
2026-05-13T14:33:41.612078Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Microdot has HTTP response splitting in Response.set_cookie()
Details

Impact

The Response.set_cookie() method does not sanitize its string arguments, and in particular will not detect the presence of the \r\n sequence in them. This can be a potential source of header injection attacks.

For a header injection attack through this issue to be possible, an attacker must first infiltrate the client (for example through an independent XSS attack), so that it can send malicious information that is destined to be stored in a cookie by the server on behalf of the victim. An attacker that infiltrates one client can only orchestrate a header injection attack for that client, all other clients that were not infiltrated are safe.

Patches

Upgrade to version 2.6.1.

Workarounds

Do not pass untrusted data to the Response.set_cookie() method.

Database specific 
{
    "github_reviewed": true,
    "severity": "LOW",
    "nvd_published_at": "2026-05-11T20:25:43Z",
    "cwe_ids": [
        "CWE-113"
    ],
    "github_reviewed_at": "2026-05-05T18:35:20Z"
}
References

Affected packages

PyPI / microdot

Package

Name
microdot
View open source insights on deps.dev
Purl
pkg:pypi/microdot

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.6.1

Affected versions

0.*
0.1.0
0.1.1
0.2.0
0.3.0
0.3.1
0.4.0
0.5.0
0.6.0
0.7.0
0.7.1
0.7.2
0.8.0
0.8.1
0.8.2
0.9.0
1.*
1.0.0
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.1.0
2.2.0
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.5.0
2.5.1
2.6.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-7wc8-wvc4-m498/GHSA-7wc8-wvc4-m498.json"