In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked …

A cookie attribute injection vulnerability was discovered in Tornado web framework versions before 6.5.5. The vulnerability occurs because the domain, path, and samesite arguments to the RequestHandler.set_cookie method were not properly validated for crafted characters. This allows attackers to inject malicious cookie attributes through these parameters. The vulnerability has been addressed in Tornado version 6.5.5. Organizations using affected versions should upgrade to the patched version immediately.