VULNERABILITY INTELLIGENCE

CVE-2026-40035

CVSS score9.1 CRITICAL
EPSS probability0.56%
CISA KEVNot currently listed
Published2026-04-08
Last modified2026-10-08
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and disclose sensitive information or achieve remote code execution.

Weakness classification

  • disclosure@vulncheck.com: CWE-489

Primary references