p PatchFirst

CVE-2026-40035

CVE-2026-40035 · Unfurl - Werkzeug Debugger Exposure via String Config Parsing

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and disclose sensitive information or achieve remote code execution.

CVSS 9.3 · Critical · EPSS 0.6%

Published
Updated

Stack: python

Affected products and versions

  • unfurl

    Versions
    • ≥ 0, ≤ 2025.08: Affected (custom)

    No fix published

  • dfir-unfurl PyPI

    Versions
    • 20200629
    • 20200630
    • 20200630.2
    • 20200630.3
    • 20200630.4
    • 20200702
    • 20200703
    • 20200729
    • 20200812
    • 20201102
    • 20210308
    • 20210309
    • 20210310
    • 20210311
    • 20210615
    • 20220200
    • 20221100
    • 20230900
    • 20230901
    • 20240625
    • 20240626
    • 20240627
    • 20241120
    • 20241121
    • 20250218
    • 20250312
    • 20250810
    Affected ranges
    • ECOSYSTEM: ≤ 20250810

    No fix published

Original sources

Check your server →