{"action":"Upgrade flask-cors to 4.0.2 or later.","affected":[{"fixed":"4.0.2","introduced":"0"}],"component":"flask-cors","cve_ids":["CVE-2024-6221"],"ecosystem":"PyPI","epss":0.00718,"exploited":false,"fixed_versions":["4.0.2"],"ghsa_id":"GHSA-hxwh-jpp2-84pm","id":"tcs_01M5KGND3Q9QVW6VPTK1KP1JD4","modified_at":"2026-07-09T16:56:25.795378335Z","published_at":"2024-08-18T19:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-71","https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d","https://github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec","https://github.com/advisories/GHSA-hxwh-jpp2-84pm"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2024-71","url":"https://osv.dev/vulnerability/PYSEC-2024-71"}],"summary":"A vulnerability in corydolphin/flask-cors up to version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavio"}