In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked …

A vulnerability in Tornado web framework versions before 6.5.5 allows cookie attribute injection attacks. The issue occurs because the domain, path, and samesite arguments to the RequestHandler.set_cookie method were not properly validated for crafted characters. Attackers could potentially inject malicious cookie attributes by providing specially crafted input to these parameters. This could lead to various security issues including session manipulation or cookie-based attacks. The vulnerability has been fixed in version 6.5.5 of the Tornado framework.