Pallets vulnerabilities
We track 7 vulnerabilities in Pallets products across 4 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on March 5, 2025.
Latest Pallets vulnerabilities
- 8.8 High severity
jinja: Improper Neutralization of Special Elements Used in a Template Engine
Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerabil
- 8.8 High severity
jinja: Improper Neutralization of Escape, Meta, or Control Sequences
Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox
- 7.5 High severity
werkzeug: Uncontrolled Resource Consumption
Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnera
- 7.5 High severity
werkzeug: Cross-Site Request Forgery
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a
- 7.5 High severity
werkzeug: Out-of-bounds Write
Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: al
- 7.5 High severity
flask: Use of Persistent Cookies Containing Sensitive Information
Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` hea
- 7.5 High severity
werkzeug: Allocation of Resources Without Limits or Throttling
Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and