{"action":"Upgrade flask to 3.1.3 or later.","affected":[{"fixed":"3.1.3","introduced":"0"}],"component":"flask","cve_ids":["CVE-2026-27205"],"ecosystem":"PyPI","epss":0.004,"exploited":false,"fixed_versions":["3.1.3"],"ghsa_id":"GHSA-68rp-wp8r-4726","id":"tcs_01M5KGXRR3ADPWEGTP5YGTAX7W","modified_at":"2026-07-13T07:15:25.033843440Z","published_at":"2026-02-21T06:17:00.910Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2151","https://github.com/pallets/flask/releases/tag/3.1.3","https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726","https://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-2151","url":"https://osv.dev/vulnerability/PYSEC-2026-2151"}],"summary":"Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Us"}