Critical severity9.1NVD Advisory· Published Apr 8, 2026· Updated Apr 17, 2026
CVE-2026-40035
CVE-2026-40035
Description
Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and disclose sensitive information or achieve remote code execution.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/obsidianforensics/unfurl/security/advisories/GHSA-vg9h-jx4v-cwx2nvdExploitVendor Advisory
- www.vulncheck.com/advisories/dfir-unfurl-werkzeug-debugger-exposure-via-string-config-parsingnvdThird Party Advisory
News mentions
0No linked articles in our index yet.