CVE-2026-40035

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-40035
Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and disclose sensitive information or achieve remote code execution.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-vg9h-jx4v-cwx2 Exploit Vendor Advisory
https://www.vulncheck.com/advisories/dfir-unfurl-werkzeug-debugger-exposure-via-string-config-parsing Third Party Advisory
https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-vg9h-jx4v-cwx2 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ryandfir:unfurl:*:*:*:*:*:*:*:*
History

24 Jul 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) Unfurl hasta 2025.08 contiene una vulnerabilidad de validación de entrada incorrecta en el análisis de configuración que habilita el modo de depuración de Flask por defecto. El valor de configuración de depuración se lee como una cadena de texto y se pasa directamente a app.run(), lo que provoca que cualquier cadena de texto no vacía se evalúe como verdadera, permitiendo a los atacantes acceder al depurador de Werkzeug y divulgar información sensible o lograr ejecución remota de código.

17 Apr 2026, 16:03

Type Values Removed Values Added
First Time Ryandfir unfurl
Ryandfir
CPE cpe:2.3:a:ryandfir:unfurl:*:*:*:*:*:*:*:*
References () https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-vg9h-jx4v-cwx2 - () https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-vg9h-jx4v-cwx2 - Exploit, Vendor Advisory
References () https://www.vulncheck.com/advisories/dfir-unfurl-werkzeug-debugger-exposure-via-string-config-parsing - () https://www.vulncheck.com/advisories/dfir-unfurl-werkzeug-debugger-exposure-via-string-config-parsing - Third Party Advisory

09 Apr 2026, 14:16

Type Values Removed Values Added
References () https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-vg9h-jx4v-cwx2 - () https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-vg9h-jx4v-cwx2 -

08 Apr 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-08 22:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-40035

Mitre link : CVE-2026-40035

CVE.ORG link : CVE-2026-40035

JSON object : View

Products Affected

ryandfir

  • unfurl
CWE
CWE-489

Active Debug Code