MEDIUM5.3

PYSEC-2026-2287

Quick fix

PYSEC-2026-2287 — tornado: upgrade to the fixed version with the command below.

pip install --upgrade 'tornado>=6.5.5'

Details

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/tornado

Introduced in: 0Fixed in: 6.5.5

Fixpip install --upgrade 'tornado>=6.5.5'

References

https://github.com/tornadoweb/tornado/releases/tag/v6.5.5[WEB]
https://github.com/tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7[ADVISORY]
https://github.com/advisories/GHSA-fqwm-6jpj-5wxc[ADVISORY]