werkzeug-3.0.1-py3-none-any.whl: 5 vulnerabilities (highest severity is: 7.5) #12
Description
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Day 62 Coffe and Wifi/requirements.txt
Path to vulnerable library: /Day 62 Coffe and Wifi/requirements.txt,/Day 61 Flask WTF Forms/requirements.txt,/Day 63 Libary Project/requirements.txt
Found in HEAD commit: 59c0f2bd7fc45c85854bdbee5b27fbcd74998c32
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Dependency | Type | Fixed in (werkzeug version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2024-34069 |  High |
7.5 | werkzeug-3.0.1-py3-none-any.whl | Direct | 3.0.3 | ❌ |
| CVE-2026-27199 |  Medium |
5.3 | werkzeug-3.0.1-py3-none-any.whl | Direct | werkzeug - 3.1.6 | ❌ |
| CVE-2026-21860 | Medium |
5.3 | werkzeug-3.0.1-py3-none-any.whl | Direct | 3.1.5 | ❌ |
| CVE-2025-66221 | Medium |
5.3 | werkzeug-3.0.1-py3-none-any.whl | Direct | 3.1.4 | ❌ |
| CVE-2024-49766 |  Low |
3.7 | werkzeug-3.0.1-py3-none-any.whl | Direct | Werkzeug - 3.0.6 | ❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-34069
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Day 62 Coffe and Wifi/requirements.txt
Path to vulnerable library: /Day 62 Coffe and Wifi/requirements.txt,/Day 61 Flask WTF Forms/requirements.txt,/Day 63 Libary Project/requirements.txt
Dependency Hierarchy:
- ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 59c0f2bd7fc45c85854bdbee5b27fbcd74998c32
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.
Publish Date: 2024-05-06
URL: CVE-2024-34069
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-2g68-c3qc-8985
Release Date: 2024-05-06
Fix Resolution: 3.0.3
Step up your Open Source Security Game with Mend here
CVE-2026-27199
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Day 62 Coffe and Wifi/requirements.txt
Path to vulnerable library: /Day 62 Coffe and Wifi/requirements.txt,/Day 61 Flask WTF Forms/requirements.txt,/Day 63 Libary Project/requirements.txt
Dependency Hierarchy:
- ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 59c0f2bd7fc45c85854bdbee5b27fbcd74998c32
Found in base branch: main
Vulnerability Details
Werkzeug's "safe_join" function allows Windows device names as filenames if when preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that "safe_join" accepts paths with multiple segments, such as "example/NUL". "send_from_directory" uses "safe_join" to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.
Publish Date: 2026-02-20
URL: CVE-2026-27199
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: GHSA-29vq-49wr-vm6x
Release Date: 2026-02-20
Fix Resolution: werkzeug - 3.1.6
Step up your Open Source Security Game with Mend here
CVE-2026-21860
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Day 62 Coffe and Wifi/requirements.txt
Path to vulnerable library: /Day 62 Coffe and Wifi/requirements.txt,/Day 61 Flask WTF Forms/requirements.txt,/Day 63 Libary Project/requirements.txt
Dependency Hierarchy:
- ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 59c0f2bd7fc45c85854bdbee5b27fbcd74998c32
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5.
Publish Date: 2026-01-08
URL: CVE-2026-21860
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: GHSA-87hc-h4r5-73f7
Release Date: 2026-01-08
Fix Resolution: 3.1.5
Step up your Open Source Security Game with Mend here
CVE-2025-66221
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Day 62 Coffe and Wifi/requirements.txt
Path to vulnerable library: /Day 62 Coffe and Wifi/requirements.txt,/Day 61 Flask WTF Forms/requirements.txt,/Day 63 Libary Project/requirements.txt
Dependency Hierarchy:
- ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 59c0f2bd7fc45c85854bdbee5b27fbcd74998c32
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.
Publish Date: 2025-11-29
URL: CVE-2025-66221
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Release Date: 2025-11-29
Fix Resolution: 3.1.4
Step up your Open Source Security Game with Mend here
CVE-2024-49766
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Day 62 Coffe and Wifi/requirements.txt
Path to vulnerable library: /Day 62 Coffe and Wifi/requirements.txt,/Day 61 Flask WTF Forms/requirements.txt,/Day 63 Libary Project/requirements.txt
Dependency Hierarchy:
- ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 59c0f2bd7fc45c85854bdbee5b27fbcd74998c32
Found in base branch: main
Vulnerability Details
Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.
Publish Date: 2024-10-25
URL: CVE-2024-49766
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-f9vj-2wh5-fj8j
Release Date: 2024-10-25
Fix Resolution: Werkzeug - 3.0.6
Step up your Open Source Security Game with Mend here