Improper Input Validation in Unfurl by Obsidian Forensics

CVE-2026-40035

What is CVE-2026-40035?

The Unfurl tool by Obsidian Forensics has a flaw in its configuration parsing that improperly validates input. This issue may unintentionally enable the Flask debug mode by default, as the debug configuration value is treated as a string and directly fed into app.run(). Consequently, any non-empty input is interpreted as truthy, potentially granting attackers access to the Werkzeug debugger. Such access could lead to the disclosure of sensitive information or even remote code execution, posing a significant threat to any application utilizing the affected version.

References