Impact

There is no known practical impact other than it is just possible to manipulate CSRF cookie and XSS the malicious user self.

Patches

Invalid characters of CSRF tokens are stripped after reading cookie. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.

Workarounds

No need for workarounds.

References

N/A

For more information

If you have any questions or comments about this advisory, please post on #6953.