CVE-2019-16935: The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has X...

Security readout for executives and security teams

This CVE is a cross-site scripting issue in Python's documentation XML-RPC server. It matters only where that server is used and its title is set from untrusted input. A visitor to the server's HTTP page could receive attacker-controlled JavaScript. The source bundle does not show active exploitation. Exposure is likely narrow: systems must use Python's documentation XML-RPC server, expose its HTTP documentation page to users, and populate server_title with untrusted data. General Python installations are not necessarily exploitable from the bundle alone. Treat as a targeted hygiene issue, not a broad emergency, unless your environment exposes Python XML-RPC documentation pages with user-controlled titles. Prioritize patching supported Python packages and confirming whether this uncommon component is used. Mitigation focus: Apply Python updates from the relevant OS or vendor advisory.; Review CPython issue 38243 and the linked CPython fix for upstream context.; Do not pass untrusted input to set_server_title..

Prepared

Jun 6, 2026, 13:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.