PT-2026-31470 · Flask+2 · Flask+2
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Unfurl versions through 2025.08
Description
Unfurl through 2025.08 has an improper input validation issue in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to
app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and potentially disclose sensitive information or achieve remote code execution.Recommendations
Update to a version later than 2025.08.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Flask
Unfurl
Werkzeug