pallets

5 results · Clear filters · Feed

• Medium 6.3
  CVE-2026-27199 Public exploit

  Werkzeug safe_join() allows Windows special device names

  Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filterin…

  pallets werkzeug werkzeug py3-werkzeug Alpine PyPI
  Feb 21, 2026
• High 7.5
  CVE-2024-34069 Public exploit

  Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

  Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a…

  pallets werkzeug werkzeug python-werkzeug Debian Ubuntu PyPI
  May 6, 2024
• Medium 5.4
  CVE-2024-34064 Public exploit

  Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

  Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separat…

  pallets jinja jinja2 jinja2 Debian Ubuntu Alpine PyPI
  May 6, 2024
• High 8.0
  CVE-2023-46136 Public exploit

  Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

  Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: a…

  pallets werkzeug werkzeug python-werkzeug Debian Alpine PyPI
  Oct 24, 2023
• High 7.5
  CVE-2023-30861 Public exploit

  Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

  Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` he…

  pallets flask flask flask Debian Ubuntu PyPI
  May 2, 2023