GitHub Advisoryadvisory · PyPI
GHSA-7rxf-gvfg-47g4 Flask-CORS improper regex path matching vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2024-6839
- Ecosystem
- PyPI
- Packages
- flask-cors
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-41
- Reviewed
- 2025-03-22
Affected packages
• PyPI flask-cors: < 6.0.0 → fixed in 6.0.0
Description
corydolphin/flask-cors version 5.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
Related
Alias · CVE (1)
- CVE-2024-6839 corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. vulnerability
Weakness · CWE (1)
- CWE-41 Improper Resolution of Path Equivalence weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-6839 advisory
- https://github.com/corydolphin/flask-cors/commit/e970988bea563e05e8b8f53fa7bcc134b5bf5c5f web
- https://github.com/corydolphin/flask-cors package
- https://github.com/corydolphin/flask-cors/blob/4.0.1/flask_cors/core.py#L73 web
- https://huntr.com/bounties/403eb1fc-86f4-4820-8eba-0f3dfae9f2b4 web
- https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html web