PT-2026-31470 · Unfurl+2 · Unfurl+2

Mobasi-Team · Published 2026-04-08 · Updated 2026-04-09 · CVE-2026-40035

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Unfurl versions through 2025.08

Description Unfurl through 2025.08 has an improper input validation issue in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and potentially disclose sensitive information or achieve remote code execution.

Recommendations Update to a version later than 2025.08.

Exploit

Fix

Weakness Enumeration

CWE-489

Related Identifiers

CVE-2026-40035

Affected Products

Flask

Unfurl

Werkzeug

References · 5

• 🔥 https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-vg9h-jx4v-cwx2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40035 · Security Note
• https://twitter.com/OrizonCyber/status/2042029745496363492 · Twitter Post
• https://twitter.com/CveFindCom/status/2042101198098932077 · Twitter Post
• https://vulncheck.com/advisories/dfir-unfurl-werkzeug-debugger-exposure-via-string-config-parsing · Note