CVE-2026-40035 - Vulnerability Analysis

Overview

Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default, letting attackers access the Werkzeug debugger to disclose sensitive information or execute code remotely, exploit requires crafted config input.

Severity & Score

Impact

Attackers can access debug tools to disclose sensitive information or execute code remotely, risking full system compromise.

Mitigation

Update to the latest version beyond 2025.08.

References

• https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-vg9h-jx4v-cwx2
• https://www.vulncheck.com/advisories/dfir-unfurl-werkzeug-debugger-exposure-via-string-config-parsing

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner