Vulnerability PYSEC-2026-2043
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
3 months ago
July 07, 2026 at 11:45 AM UTC
Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
0.1 - 3.0.2
0.1 - 3.0.2
Summary
Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
Details
The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
8 hours ago
Werkzeug safe_join() allows Windows special device names
0.1 - 3.1.8 GHSA-g6x2-hccm-hh4m
0.1 - 3.1.8 GHSA-g6x2-hccm-hh4m
High Risk
2 months ago
Werkzeug possible resource exhaustion when parsing file data in forms
2.0.0rc1 - 3.0.5 PYSEC-2026-3417
2.0.0rc1 - 3.0.5 PYSEC-2026-3417
Medium Risk
3 months ago
Werkzeug safe_join() allows Windows special device names with compound extensions
0.1 - 3.1.4 PYSEC-2026-2044
0.1 - 3.1.4 PYSEC-2026-2044
Unknown
3 months ago
Werkzeug safe_join() allows Windows special device names
0.1 - 3.1.3 PYSEC-2026-2046
0.1 - 3.1.3 PYSEC-2026-2046
Unknown
3 months ago
Werkzeug safe_join not safe on Windows
0.1 - 3.0.5 PYSEC-2026-2045
0.1 - 3.0.5 PYSEC-2026-2045
Impacted packages
Timeline
Published
3 months ago
July 07, 2026 at 11:45 AM UTC
Fixed (3.0.3)
2 years ago
May 05, 2024 at 11:10 PM UTC
Last Modified
3 months ago
July 07, 2026 at 05:47 PM UTC