Vulnerable code sample

from microdot import Microdot, Response

# This code represents a vulnerable application using a version of
# Microdot prior to 2.6.1, demonstrating CVE-2026-42874.
# The `Response.set_cookie()` method does not sanitize its arguments
# for newline characters, which can lead to HTTP header injection.

app = Microdot()

@app.route('/set-info')
def set_user_info(request):
    """
    This endpoint takes a user-provided 'info' value from the query string
    and sets it in a cookie. This simulates a scenario where an application
    reflects user input into a cookie.

    An attacker can exploit this by providing a crafted 'info' value
    containing a CRLF sequence (\r\n) to inject a new header.

    Example of a malicious request URL:
    /set-info?info=some_value%0d%0aInjected-Header:%20malicious_content
    """
    # Get the potentially malicious value from the request.
    # An attacker must have a way to control this input for a target user.
    user_info = request.args.get('info')

    if not user_info:
        return Response('Missing "info" parameter', status_code=400)

    response = Response('Your info has been set.')

    # In vulnerable versions (< 2.6.1), the `user_info` string is not
    # sanitized. If it contains "\r\n", it will split the "Set-Cookie"
    # header and inject a new, attacker-controlled header into the response.
    response.set_cookie('user_info', user_info)

    return response