mediumCVSS 5.4Vulnerability
GHSA-78cv-mqj4-43f7
Values passed to the `domain`, `path`, and `samesite` arguments of `RequestHandler.set_cookie` were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.
Properties
- ghsa_id
- GHSA-78cv-mqj4-43f7
- severity
- medium
- summary
- Tornado has incomplete validation of cookie attributes
- cvss_score
- 5.4
- cve_id
- GHSA-78cv-mqj4-43f7
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- is_ghsa_only
- true
- ghsa_published
- 2026-03-11T22:17:00Z
- source_url
- https://github.com/advisories/GHSA-78cv-mqj4-43f7
- ghsa_updated
- 2026-03-11T22:17:04Z
Related Entities (3)
AFFECTS (1)
→[Software]pip/tornado
HAS_WEAKNESS (1)
→[Weakness]Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph