PyPI: flask-cors
CVE-2024-1681
Safety vulnerability ID: SFTY-20240419-90883
Safety legacy ID: pyup.io-70624
Affected versions of the flask-cors package are vulnerable to Improper Output Neutralization for Logs due to unsanitized request path values being written to the debug logger. In flask_cors.extension.CORS, request.path is logged via LOG.debug without normalizing or escaping CRLF characters when DEBUG logging is enabled, as evidenced by the logging site in extension.py and the fix that cleans request.path before logging.
Overview
flask-cors vulnerable to log injection when the log level is set to debug
Advisory
Affected versions of the flask-cors package are vulnerable to Improper Output Neutralization for Logs due to unsanitized request path values being written to the debug logger. In flask_cors.extension.CORS, request.path is logged via LOG.debug without normalizing or escaping CRLF characters when DEBUG logging is enabled, as evidenced by the logging site in extension.py and the fix that cleans request.path before logging.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20240419-90883/CVE-2024-1681
- https://nvd.nist.gov/vuln/detail/CVE-2024-1681
- https://huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644
- https://github.com/corydolphin/flask-cors/blob/40acc8092332dfed4bb54d7a4f89a6d479466de7/flask_cors/extension.py#L194
- https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html
- https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-271.yaml
- https://github.com/advisories/GHSA-84pr-m4jr-85g5
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more