CVE-2026-40035

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40035
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40035.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40035
Aliases
Published
2026-04-08T21:35:27.703Z
Modified
2026-08-12T03:51:09.324607214Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Unfurl - Werkzeug Debugger Exposure via String Config Parsing
Details

Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and disclose sensitive information or achieve remote code execution.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-489"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40035.json"
}
References

Affected packages

Git / github.com/RyanDFIR/unfurl

Affected ranges

Type
GIT
Repo
https://github.com/RyanDFIR/unfurl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f0d0a7c350d482bcd5de75fa542c7189126cf71a
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:ryandfir:unfurl:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2025.08"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

Other
20200812
20201102
v2021.*
v2021.03.11
v2021.06.15
v2022.*
v2022.02
v2022.11
v2022.11.01
v2023.*
v2023.09
v2023.09.01
v2023.09.02
v2023.09.03
v2023.09.04
v2023.09.05
v2024.*
v2024.06
v2024.06.26
v2024.06.27
v2024.11
v2024.11.20
v2025.*
v2025.02
v2025.03
v2025.08

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40035.json"