Open redirect in Flask-Unchained

MITTEL 5.4CVE-2021-23393 · GHSA-pjc4-3w99-j7v4 · PYSEC-2021-96 · Published 11/06/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-23393 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in flask-unchained, flask unchained (flask unchained project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.72%, höher als bei 54.0% aller Schwachstellen.
Abhilfe: auf 0.9.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
flask-unchained PyPI	`< 0.9.0`	`0.9.0`
flask unchained flask_unchained_project	`< 0.9.0`	`0.9.0`

Description

This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.

NVD description

This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.

References

nvd.nist.gov/vuln/detail/CVE-2021-23393 · ADVISORY
briancappello/flask-unchained commit 2bfeedf · WEB
briancappello/flask-unchained commit 71e36b2 · WEB
GitHub Advisory GHSA-pjc4-3w99-j7v4 · ADVISORY
pypa/advisory-database · WEB
snyk.io/vuln/SNYK-PYTHON-FLASKUNCHAINED-1293189 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

flask-unchained

PyPI

< 0.9.0

0.9.0

flask unchained

flask_unchained_project

< 0.9.0

0.9.0

Description

NVD description

This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.