Vulnerable Library - Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/PyJWT-2.8.0.dist-info
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (Flask_JWT_Extended version) |
Remediation Possible** |
| CVE-2026-32597 |
 High |
7.5 |
PyJWT-2.8.0-py3-none-any.whl |
Transitive |
4.7.0 |
❌ |
| CVE-2024-34069 |
High |
7.5 |
werkzeug-3.0.1-py3-none-any.whl |
Transitive |
4.7.0 |
❌ |
| CVE-2026-48526 |
High |
7.4 |
PyJWT-2.8.0-py3-none-any.whl |
Transitive |
N/A* |
❌ |
| CVE-2026-48525 |
 Medium |
5.3 |
PyJWT-2.8.0-py3-none-any.whl |
Transitive |
N/A* |
❌ |
| CVE-2026-27199 |
Medium |
5.3 |
werkzeug-3.0.1-py3-none-any.whl |
Transitive |
4.7.0 |
❌ |
| CVE-2026-21860 |
Medium |
5.3 |
werkzeug-3.0.1-py3-none-any.whl |
Transitive |
4.7.0 |
❌ |
| CVE-2025-66221 |
Medium |
5.3 |
werkzeug-3.0.1-py3-none-any.whl |
Transitive |
4.7.0 |
❌ |
| CVE-2024-49767 |
Medium |
5.3 |
werkzeug-3.0.1-py3-none-any.whl |
Transitive |
4.7.0 |
❌ |
| CVE-2026-48522 |
Medium |
4.2 |
PyJWT-2.8.0-py3-none-any.whl |
Transitive |
N/A* |
❌ |
| CVE-2026-48524 |
 Low |
3.7 |
PyJWT-2.8.0-py3-none-any.whl |
Transitive |
N/A* |
❌ |
| CVE-2024-49766 |
Low |
3.7 |
werkzeug-3.0.1-py3-none-any.whl |
Transitive |
N/A* |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-32597
Vulnerable Library - PyJWT-2.8.0-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/2b/4f/e04a8067c7c96c364cef7ef73906504e2f40d690811c021e1a1901473a19/PyJWT-2.8.0-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/PyJWT-2.8.0.dist-info
Dependency Hierarchy:
- Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
- ❌ PyJWT-2.8.0-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
Publish Date: 2026-03-12
URL: CVE-2026-32597
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-752w-5fwx-jx9f
Release Date: 2026-03-12
Fix Resolution (PyJWT): 2.12.0
Direct dependency fix Resolution (Flask-JWT-Extended): 4.7.0
Step up your Open Source Security Game with Mend here
CVE-2024-34069
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info
Dependency Hierarchy:
- Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
- ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.
Publish Date: 2024-05-06
URL: CVE-2024-34069
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-2g68-c3qc-8985
Release Date: 2024-05-06
Fix Resolution (Werkzeug): 3.0.3
Direct dependency fix Resolution (Flask-JWT-Extended): 4.7.0
Step up your Open Source Security Game with Mend here
CVE-2026-48526
Vulnerable Library - PyJWT-2.8.0-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/2b/4f/e04a8067c7c96c364cef7ef73906504e2f40d690811c021e1a1901473a19/PyJWT-2.8.0-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/PyJWT-2.8.0.dist-info
Dependency Hierarchy:
- Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
- ❌ PyJWT-2.8.0-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48526
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-xgmm-8j9v-c9wx
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
Step up your Open Source Security Game with Mend here
CVE-2026-48525
Vulnerable Library - PyJWT-2.8.0-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/2b/4f/e04a8067c7c96c364cef7ef73906504e2f40d690811c021e1a1901473a19/PyJWT-2.8.0-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/PyJWT-2.8.0.dist-info
Dependency Hierarchy:
- Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
- ❌ PyJWT-2.8.0-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled “work amplifier”: a remote client can supply an arbitrarily large Base64URL payload segment that forces CPU work + memory allocations even if the signature is invalid. This creates an unauthenticated DoS vector against any endpoint that verifies detached JWS using PyJWT. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48525
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-w7vc-732c-9m39
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
Step up your Open Source Security Game with Mend here
CVE-2026-27199
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info
Dependency Hierarchy:
- Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
- ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been fixed in version 3.1.6.
Publish Date: 2026-02-21
URL: CVE-2026-27199
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-02-21
Fix Resolution (Werkzeug): 3.1.6
Direct dependency fix Resolution (Flask-JWT-Extended): 4.7.0
Step up your Open Source Security Game with Mend here
CVE-2026-21860
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info
Dependency Hierarchy:
- Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
- ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5.
Publish Date: 2026-01-08
URL: CVE-2026-21860
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-87hc-h4r5-73f7
Release Date: 2026-01-08
Fix Resolution (Werkzeug): 3.1.5
Direct dependency fix Resolution (Flask-JWT-Extended): 4.7.0
Step up your Open Source Security Game with Mend here
CVE-2025-66221
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info
Dependency Hierarchy:
- Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
- ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.
Publish Date: 2025-11-29
URL: CVE-2025-66221
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2025-11-29
Fix Resolution (Werkzeug): 3.1.4
Direct dependency fix Resolution (Flask-JWT-Extended): 4.7.0
Step up your Open Source Security Game with Mend here
CVE-2024-49767
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info
Dependency Hierarchy:
- Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
- ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Werkzeug is a Web Server Gateway Interface web application library. Applications using "werkzeug.formparser.MultiPartParser" corresponding to a version of Werkzeug prior to 3.0.6 to parse "multipart/form-data" requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2024-10-25
URL: CVE-2024-49767
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-q34m-jh98-gwm2
Release Date: 2024-10-25
Fix Resolution (Werkzeug): 3.0.6
Direct dependency fix Resolution (Flask-JWT-Extended): 4.7.0
Step up your Open Source Security Game with Mend here
CVE-2026-48522
Vulnerable Library - PyJWT-2.8.0-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/2b/4f/e04a8067c7c96c364cef7ef73906504e2f40d690811c021e1a1901473a19/PyJWT-2.8.0-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/PyJWT-2.8.0.dist-info
Dependency Hierarchy:
- Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
- ❌ PyJWT-2.8.0-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parameter), the attacker can cause PyJWKClient to read arbitrary local files via file:// (SSRF on local filesystem), cause PyJWKClient to attempt FTP / data-URI fetches (broader SSRF surface), or forge tokens that PyJWT verifies as valid. The library does not directly return non-HTTP(S) URI contents to the attacker; the chained "plant a JWKS to forge tokens" scenario described in the original report requires additional application-layer flaws (attacker write access to a filesystem path, untrusted jku derivation) that this fix does not address. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48522
CVSS 3 Score Details (4.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-993g-76c3-p5m4
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
Step up your Open Source Security Game with Mend here
CVE-2026-48524
Vulnerable Library - PyJWT-2.8.0-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/2b/4f/e04a8067c7c96c364cef7ef73906504e2f40d690811c021e1a1901473a19/PyJWT-2.8.0-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/PyJWT-2.8.0.dist-info
Dependency Hierarchy:
- Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
- ❌ PyJWT-2.8.0-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48524
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-fhv5-28vv-h8m8
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
Step up your Open Source Security Game with Mend here
CVE-2024-49766
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info
Dependency Hierarchy:
- Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
- ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.
Publish Date: 2024-10-25
URL: CVE-2024-49766
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-f9vj-2wh5-fj8j
Release Date: 2024-10-25
Fix Resolution: werkzeug - 3.0.6,werkzeug - 3.0.6
Step up your Open Source Security Game with Mend here
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/PyJWT-2.8.0.dist-info
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - PyJWT-2.8.0-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/2b/4f/e04a8067c7c96c364cef7ef73906504e2f40d690811c021e1a1901473a19/PyJWT-2.8.0-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/PyJWT-2.8.0.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
Publish Date: 2026-03-12
URL: CVE-2026-32597
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-752w-5fwx-jx9f
Release Date: 2026-03-12
Fix Resolution (PyJWT): 2.12.0
Direct dependency fix Resolution (Flask-JWT-Extended): 4.7.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.
Publish Date: 2024-05-06
URL: CVE-2024-34069
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-2g68-c3qc-8985
Release Date: 2024-05-06
Fix Resolution (Werkzeug): 3.0.3
Direct dependency fix Resolution (Flask-JWT-Extended): 4.7.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - PyJWT-2.8.0-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/2b/4f/e04a8067c7c96c364cef7ef73906504e2f40d690811c021e1a1901473a19/PyJWT-2.8.0-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/PyJWT-2.8.0.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48526
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-xgmm-8j9v-c9wx
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - PyJWT-2.8.0-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/2b/4f/e04a8067c7c96c364cef7ef73906504e2f40d690811c021e1a1901473a19/PyJWT-2.8.0-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/PyJWT-2.8.0.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled “work amplifier”: a remote client can supply an arbitrarily large Base64URL payload segment that forces CPU work + memory allocations even if the signature is invalid. This creates an unauthenticated DoS vector against any endpoint that verifies detached JWS using PyJWT. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48525
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-w7vc-732c-9m39
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been fixed in version 3.1.6.
Publish Date: 2026-02-21
URL: CVE-2026-27199
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-02-21
Fix Resolution (Werkzeug): 3.1.6
Direct dependency fix Resolution (Flask-JWT-Extended): 4.7.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5.
Publish Date: 2026-01-08
URL: CVE-2026-21860
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-87hc-h4r5-73f7
Release Date: 2026-01-08
Fix Resolution (Werkzeug): 3.1.5
Direct dependency fix Resolution (Flask-JWT-Extended): 4.7.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.
Publish Date: 2025-11-29
URL: CVE-2025-66221
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2025-11-29
Fix Resolution (Werkzeug): 3.1.4
Direct dependency fix Resolution (Flask-JWT-Extended): 4.7.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Werkzeug is a Web Server Gateway Interface web application library. Applications using "werkzeug.formparser.MultiPartParser" corresponding to a version of Werkzeug prior to 3.0.6 to parse "multipart/form-data" requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2024-10-25
URL: CVE-2024-49767
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-q34m-jh98-gwm2
Release Date: 2024-10-25
Fix Resolution (Werkzeug): 3.0.6
Direct dependency fix Resolution (Flask-JWT-Extended): 4.7.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - PyJWT-2.8.0-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/2b/4f/e04a8067c7c96c364cef7ef73906504e2f40d690811c021e1a1901473a19/PyJWT-2.8.0-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/PyJWT-2.8.0.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parameter), the attacker can cause PyJWKClient to read arbitrary local files via file:// (SSRF on local filesystem), cause PyJWKClient to attempt FTP / data-URI fetches (broader SSRF surface), or forge tokens that PyJWT verifies as valid. The library does not directly return non-HTTP(S) URI contents to the attacker; the chained "plant a JWKS to forge tokens" scenario described in the original report requires additional application-layer flaws (attacker write access to a filesystem path, untrusted jku derivation) that this fix does not address. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48522
CVSS 3 Score Details (4.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-993g-76c3-p5m4
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - PyJWT-2.8.0-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/2b/4f/e04a8067c7c96c364cef7ef73906504e2f40d690811c021e1a1901473a19/PyJWT-2.8.0-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/PyJWT-2.8.0.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48524
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-fhv5-28vv-h8m8
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl
Path to dependency file: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.
Publish Date: 2024-10-25
URL: CVE-2024-49766
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-f9vj-2wh5-fj8j
Release Date: 2024-10-25
Fix Resolution: werkzeug - 3.0.6,werkzeug - 3.0.6
Step up your Open Source Security Game with Mend here