PYSEC-2026-1384
Flask-CORS improper regex path matching vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2024-6839
- Aliases
- GHSA-7rxf-gvfg-47g4
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Description
corydolphin/flask-cors version 5.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
Affected packages
| Package | Versions |
|---|---|
| PyPI · flask-cors | introduced 0, fixed 6.0.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-6839 ADVISORY
- https://github.com/corydolphin/flask-cors/commit/e970988bea563e05e8b8f53fa7bcc134b5bf5c5f WEB
- https://github.com/corydolphin/flask-cors PACKAGE
- https://github.com/corydolphin/flask-cors/blob/4.0.1/flask_cors/core.py#L73 WEB
- https://huntr.com/bounties/403eb1fc-86f4-4820-8eba-0f3dfae9f2b4 WEB
- https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html WEB
- https://pypi.org/project/flask-cors PACKAGE
- https://github.com/advisories/GHSA-7rxf-gvfg-47g4 ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |