Header Injection Vulnerability in Microdot Python Web Framework

CVE-2026-42874

What is CVE-2026-42874?

Microdot, a minimalist Python web framework, exhibits a header injection vulnerability in versions prior to 2.6.1. This vulnerability arises from the Response.set_cookie() method, which fails to properly sanitize string arguments. Specifically, it does not detect the insertion of the \r\n sequence, which can lead to potential header injection attacks. For such an attack to succeed, an attacker must first penetrate the client, often through an independent XSS attack. Once compromised, the client can send malicious data to be stored in a cookie by the server. However, this threat is isolated to the affected client and does not impact others who remain uncompromised. The issue has been addressed in version 2.6.1.

References