mediumCVSS 5.4Vulnerability

GHSA-78cv-mqj4-43f7

Values passed to the `domain`, `path`, and `samesite` arguments of `RequestHandler.set_cookie` were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.

Properties

ghsa_id
GHSA-78cv-mqj4-43f7
severity
medium
summary
Tornado has incomplete validation of cookie attributes
cvss_score
5.4
cve_id
GHSA-78cv-mqj4-43f7
cvss_vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
is_ghsa_only
true
ghsa_published
2026-03-11T22:17:00Z
source_url
https://github.com/advisories/GHSA-78cv-mqj4-43f7
ghsa_updated
2026-03-11T22:17:04Z

Related Entities (3)

AFFECTS (1)

[Software]pip/tornado

HAS_WEAKNESS (1)

[Weakness]Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

REPORTED_BY (1)

[Source]GitHub Advisory Database

Explore deeper with Ninja Signal's threat intelligence graph