{"action":"Upgrade flask-cors to 4.0.2 or later.","affected":[{"fixed":"4.0.2","introduced":"0"}],"component":"flask-cors","cve_ids":["CVE-2024-6221"],"ecosystem":"PyPI","epss":0.00718,"exploited":false,"fixed_versions":["4.0.2"],"ghsa_id":"GHSA-hxwh-jpp2-84pm","id":"tcs_01M5KFMRZAWR0YYWFX1JC6M1PM","modified_at":"2026-09-10T03:50:18.161615963Z","published_at":"2024-08-18T21:31:07Z","references":["https://osv.dev/vulnerability/GHSA-hxwh-jpp2-84pm","https://nvd.nist.gov/vuln/detail/CVE-2024-6221","https://github.com/corydolphin/flask-cors/issues/362","https://github.com/corydolphin/flask-cors/pull/363","https://github.com/corydolphin/flask-cors/pull/368","https://github.com/corydolphin/flask-cors/commit/03aa3f8e2256437f7bad96422a747b98ab5e31bf","https://github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec","https://github.com/corydolphin/flask-cors/commit/c8514760cf03fcce16d77f6db7007aad429c4548","https://github.com/corydolphin/flask-cors","https://github.com/corydolphin/flask-cors/releases","https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-260.yaml","https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-71.yaml","https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-hxwh-jpp2-84pm","url":"https://osv.dev/vulnerability/GHSA-hxwh-jpp2-84pm"}],"summary":"Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default"}