flask-3.0.0-py3-none-any.whl: 5 vulnerabilities (highest severity is: 7.3) #14
Description
Vulnerable Library - flask-3.0.0-py3-none-any.whl
A simple framework for building complex web applications.
Library home page: https://files.pythonhosted.org/packages/36/42/015c23096649b908c809c69388a805a571a3bea44362fe87e33fc3afa01f/flask-3.0.0-py3-none-any.whl
Path to dependency file: /Day 66 REST API/requirements.txt
Path to vulnerable library: /Day 66 REST API/requirements.txt
Found in HEAD commit: 59c0f2bd7fc45c85854bdbee5b27fbcd74998c32
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Dependency | Type | Fixed in (flask version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2025-27516 |  High |
7.3 | jinja2-3.1.5-py3-none-any.whl | Transitive | N/A* | ❌ |
| CVE-2026-27199 |  Medium |
5.3 | werkzeug-3.0.6-py3-none-any.whl | Transitive | N/A* | ❌ |
| CVE-2026-21860 | Medium |
5.3 | werkzeug-3.0.6-py3-none-any.whl | Transitive | 3.0.1 | ❌ |
| CVE-2025-66221 | Medium |
5.3 | werkzeug-3.0.6-py3-none-any.whl | Transitive | 3.0.1 | ❌ |
| CVE-2026-27205 | Medium |
4.3 | flask-3.0.0-py3-none-any.whl | Direct | flask - 3.1.3 | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2025-27516
Vulnerable Library - jinja2-3.1.5-py3-none-any.whl
A very fast and expressive template engine.
Library home page: https://files.pythonhosted.org/packages/bd/0f/2ba5fbcd631e3e88689309dbe978c5769e883e4b84ebfe7da30b43275c5a/jinja2-3.1.5-py3-none-any.whl
Path to dependency file: /Day 66 REST API/requirements.txt
Path to vulnerable library: /Day 66 REST API/requirements.txt,/Day 61 Flask WTF Forms/requirements.txt,/Day 67 Upgraded Blog/requirements.txt,/Day 64 Top 10 movies website/requirements.txt,/Day 63 Libary Project/requirements.txt,/Day 62 Coffe and Wifi/requirements.txt
Dependency Hierarchy:
- flask-3.0.0-py3-none-any.whl (Root Library)
- ❌ jinja2-3.1.5-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 59c0f2bd7fc45c85854bdbee5b27fbcd74998c32
Found in base branch: main
Vulnerability Details
Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup. This vulnerability is fixed in 3.1.6.
Publish Date: 2025-03-05
URL: CVE-2025-27516
CVSS 3 Score Details (7.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2025-03-05
Fix Resolution: 3.1.6
Step up your Open Source Security Game with Mend here
CVE-2026-27199
Vulnerable Library - werkzeug-3.0.6-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/6c/69/05837f91dfe42109203ffa3e488214ff86a6d68b2ed6c167da6cdc42349b/werkzeug-3.0.6-py3-none-any.whl
Path to dependency file: /Day 66 REST API/requirements.txt
Path to vulnerable library: /Day 66 REST API/requirements.txt
Dependency Hierarchy:
- flask-3.0.0-py3-none-any.whl (Root Library)
- ❌ werkzeug-3.0.6-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 59c0f2bd7fc45c85854bdbee5b27fbcd74998c32
Found in base branch: main
Vulnerability Details
Werkzeug's "safe_join" function allows Windows device names as filenames if when preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that "safe_join" accepts paths with multiple segments, such as "example/NUL". "send_from_directory" uses "safe_join" to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.
Publish Date: 2026-02-20
URL: CVE-2026-27199
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: GHSA-29vq-49wr-vm6x
Release Date: 2026-02-20
Fix Resolution: werkzeug - 3.1.6
Step up your Open Source Security Game with Mend here
CVE-2026-21860
Vulnerable Library - werkzeug-3.0.6-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/6c/69/05837f91dfe42109203ffa3e488214ff86a6d68b2ed6c167da6cdc42349b/werkzeug-3.0.6-py3-none-any.whl
Path to dependency file: /Day 66 REST API/requirements.txt
Path to vulnerable library: /Day 66 REST API/requirements.txt
Dependency Hierarchy:
- flask-3.0.0-py3-none-any.whl (Root Library)
- ❌ werkzeug-3.0.6-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 59c0f2bd7fc45c85854bdbee5b27fbcd74998c32
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5.
Publish Date: 2026-01-08
URL: CVE-2026-21860
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: GHSA-87hc-h4r5-73f7
Release Date: 2026-01-08
Fix Resolution (Werkzeug): 3.1.5
Direct dependency fix Resolution (Flask): 3.0.1
Step up your Open Source Security Game with Mend here
CVE-2025-66221
Vulnerable Library - werkzeug-3.0.6-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/6c/69/05837f91dfe42109203ffa3e488214ff86a6d68b2ed6c167da6cdc42349b/werkzeug-3.0.6-py3-none-any.whl
Path to dependency file: /Day 66 REST API/requirements.txt
Path to vulnerable library: /Day 66 REST API/requirements.txt
Dependency Hierarchy:
- flask-3.0.0-py3-none-any.whl (Root Library)
- ❌ werkzeug-3.0.6-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 59c0f2bd7fc45c85854bdbee5b27fbcd74998c32
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.
Publish Date: 2025-11-29
URL: CVE-2025-66221
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Release Date: 2025-11-29
Fix Resolution (Werkzeug): 3.1.4
Direct dependency fix Resolution (Flask): 3.0.1
Step up your Open Source Security Game with Mend here
CVE-2026-27205
Vulnerable Library - flask-3.0.0-py3-none-any.whl
A simple framework for building complex web applications.
Library home page: https://files.pythonhosted.org/packages/36/42/015c23096649b908c809c69388a805a571a3bea44362fe87e33fc3afa01f/flask-3.0.0-py3-none-any.whl
Path to dependency file: /Day 66 REST API/requirements.txt
Path to vulnerable library: /Day 66 REST API/requirements.txt
Dependency Hierarchy:
- ❌ flask-3.0.0-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 59c0f2bd7fc45c85854bdbee5b27fbcd74998c32
Found in base branch: main
Vulnerability Details
When the "session" object is accessed, Flask should set the "Vary: Cookie" header. This instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python "in" operator were overlooked. The severity depends on the application's use of the session, and the cache's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not ignore responses with cookies. 2. The application does not set a "Cache-Control" header to indicate that a page is private or should not be cached. 3. The application accesses the session in a way that does not access the values, only the keys, and does not mutate the session.
Publish Date: 2026-02-20
URL: CVE-2026-27205
CVSS 3 Score Details (4.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-68rp-wp8r-4726
Release Date: 2026-02-20
Fix Resolution: flask - 3.1.3
Step up your Open Source Security Game with Mend here