{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"4.0.0"}],"component":"flask-cors","cve_ids":["CVE-2024-1681"],"ecosystem":"PyPI","epss":0.00579,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-84pr-m4jr-85g5","id":"tcs_01M5KGMVGPKJNTXSAWRFD676R8","modified_at":"2026-06-10T17:01:16.365143709Z","published_at":"2024-04-19T20:15:09.273Z","references":["https://osv.dev/vulnerability/PYSEC-2024-271","https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html","https://huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644","https://github.com/advisories/GHSA-84pr-m4jr-85g5"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2024-271","url":"https://osv.dev/vulnerability/PYSEC-2024-271"}],"summary":"corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containin"}