PT-2026-31470

CVE-2026-40035

Published

2026-01-29

Updated

2026-10-08

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Unfurl versions through 2025.08

Description Unfurl through 2025.08 has an improper input validation issue in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and potentially disclose sensitive information or achieve remote code execution.

Recommendations Update to a version later than 2025.08.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-489: Active Debug Code

Related identifiers

CVE-2026-40035