CVE-2026-40035

The configuration value responsible for debug mode is read as a string and passed directly to the app.run() function. In Python, every non-empty string is treated as a logical truth value (truthy), regardless of its content — even the value 'false' passed as a string will enable debug mode. As a result, Flask starts with the active Werkzeug debugger, which is accessible over the network without any authentication. The attacker gains access to the debugger's interactive console, allowing execution of arbitrary Python code in the application's context.

An attacker without any authentication can execute arbitrary code on the server (RCE) or gain access to sensitive information processed by the application.

Apply patches available from the vendor according to references (GitHub Security Advisory GHSA-vg9h-jx4v-cwx2). As a workaround, ensure that the debug mode configuration value is passed as a boolean type, not a string, and that the Werkzeug debugger is not exposed to network traffic (e.g., by restricting access at the firewall level).

Ryandfir Unfurl in versions through 2025.08 inclusive