CVE-2026-40035
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger.
Risk Assessment
An attacker can access the Werkzeug debugger, potentially leading to disclosure of sensitive information or remote code execution.
Recommendation
Update Unfurl to a version later than 2025.08 that properly validates the debug configuration.
Original NVD description (English source)
Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and disclose sensitive information or achieve remote code execution.