CVE-2026-40035

BRIEFING NOTE: CVE-2026-40035 Unfurl through version 2025.08 contains an improper input validation vulnerability in its configuration parsing module that unexpectedly enables Flask debug mode by default. The vulnerability stems from the debug configuration value being read as a string and passed directly to app.run() without proper type conversion, causing any non-empty string to evaluate as true. This flaw affects Unfurl deployments relying on this configuration mechanism. The vulnerability carries a CVSS 3.1 critical severity rating of 9.1, with a network-based attack vector requiring no privileges or user interaction. Attack complexity is low, indicating straightforward exploitation. The impact is severe, enabling attackers to access the Werkzeug debugger and either disclose sensitive information or achieve remote code execution on affected systems. The vulnerability is not currently listed in the Known Exploited Vulnerabilities catalog and remains inactive on security hot lists. The EPSS score of 0.00122 suggests relatively low probability of exploitation in the wild compared to other CVEs, though the critical CVSS rating and serious functional impact warrant prompt patching. No public exploit code has been widely documented at this time, though the simplicity of the vulnerability could enable rapid development of proof-of-concept code.