{"action":"Upgrade flask-cors to 4.0.1 or later.","affected":[{"fixed":"4.0.1","introduced":"0"}],"component":"flask-cors","cve_ids":["CVE-2024-1681"],"ecosystem":"PyPI","epss":0.00579,"exploited":false,"fixed_versions":["4.0.1"],"ghsa_id":"GHSA-84pr-m4jr-85g5","id":"tcs_01M5KF79M3GS1EM5HR67B88KJR","modified_at":"2026-09-10T03:50:12.410188532Z","published_at":"2024-04-19T21:31:08Z","references":["https://osv.dev/vulnerability/GHSA-84pr-m4jr-85g5","https://nvd.nist.gov/vuln/detail/CVE-2024-1681","https://github.com/corydolphin/flask-cors","https://github.com/corydolphin/flask-cors/blob/40acc8092332dfed4bb54d7a4f89a6d479466de7/flask_cors/extension.py#L194","https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-271.yaml","https://huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644","https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-84pr-m4jr-85g5","url":"https://osv.dev/vulnerability/GHSA-84pr-m4jr-85g5"}],"summary":"flask-cors vulnerable to log injection when the log level is set to debug"}