Vulnerability · Published Apr 8, 2026 · Assigned by VulnCheck

CVE-2026-40035Unfurl - Werkzeug Debugger Exposure via String Config Parsing

Critical 9.1

In plain English

A critical-severity security flaw in unfurl from obsidianforensics. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.6%top 52.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and disclose sensitive information or achieve remote code execution.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	dfir-unfurl	no fix listed	GHSA-vg9h-jx4v-cwx2

Affected products (as reported)

Vendor	Product	Versions
obsidianforensics	unfurl	0 – through 2025.08

Weakness: CWE-489 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

GHSA Advisory GHSA-vg9h-jx4v-cwx2 vendor-advisory
VulnCheck Advisory: dfir-unfurl - Werkzeug Debugger Exposure via String Config Parsing third-party-advisory