Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 8, 2026 · NIST NVD

   Detected

   Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and disclose sensitive information or achieve remote code execution.

2. Oct 8, 2026 · NIST NVD

   Updated

   Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and disclose sensitive information or achieve remote code execution.

Affected

• cpe ryandfir/unfurlversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-40035

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-40035

  Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing att

  nvd.nist.gov

References

• Exploit · github.com
• Third Party Advisory · vulncheck.com