{"action":"Upgrade webargs to 5.5.3 or later.","affected":[{"fixed":"5.5.3","introduced":"5.0.0"}],"component":"webargs","cve_ids":["CVE-2020-7965"],"ecosystem":"PyPI","epss":0.00606,"exploited":false,"fixed_versions":["5.5.3"],"ghsa_id":"GHSA-fjq3-5pxw-4wj4","id":"tcs_01M5KG9M93RZFKP8S8FSJ55RVX","modified_at":"2023-11-08T04:04:12.236992Z","published_at":"2020-01-29T15:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-156","https://webargs.readthedocs.io/en/latest/changelog.html","https://github.com/advisories/GHSA-fjq3-5pxw-4wj4"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-156","url":"https://osv.dev/vulnerability/PYSEC-2020-156"}],"summary":"flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the c"}