{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"flask-user","cve_ids":["CVE-2021-23401"],"ecosystem":"PyPI","epss":0.01113,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-4298-89hc-6rfv","id":"tcs_01M5KGCEJGC59B788VXFNGA0RT","modified_at":"2023-11-08T04:05:07.511361Z","published_at":"2021-07-05T11:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-337","https://snyk.io/vuln/SNYK-PYTHON-FLASKUSER-1293188","https://github.com/lingthio/Flask-User","https://github.com/lingthio/Flask-User/blob/master/flask_user/user_manager__utils.py","https://github.com/advisories/GHSA-4298-89hc-6rfv"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-337","url":"https://osv.dev/vulnerability/PYSEC-2021-337"}],"summary":"This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slash"}