tendril-framework (>=0.1.0a3, <=0.1.0a6) potentially affected by CVE-2021-23401 via flask-user (0.6.1)

flask-user PYPI version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-user and may be impacted: - tendril-framework =0.1.0a3, =0.1.0a6 Source cves: CVE-2021-23401 Source advisory: OSV:GHSA-4298-89HC-6RFV...

lamon (0.1.0) potentially affected by CVE-2021-23401 via flask-user (0.6.21)

flask-user PYPI version 0.6.21 is affected by a known vulnerability. The following packages have a transitive dependency on flask-user and may be impacted: - lamon 0.1.0 Source cves: CVE-2021-23401 Source advisory: OSV:PYSEC-2021-337...

bivouac-framework (0.1.0a0), cornerstonecms (>=0.1.0, <=0.1.20) +5 more potentially affected by CVE-2021-23401 via flask-user (1.0.2.2)

flask-user PYPI version 1.0.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-user and may be impacted: - bivouac-framework 0.1.0a0 - cornerstonecms =0.1.0, =0.1.0, =0.0.39, =0.8.8, =0.1.0, =0.1.1a6 Source cves: CVE-2021-23401 Source advisory:...

CVE-2021-23401

Vulnerability (CVE-2021-23401) affects all versions of Flask-User. The issue occurs in the make_safe_url function, which can bypass URL validation and redirect to an arbitrary URL when multiple backslashes are provided (e.g., /////evil.com/path or \\evil.com/path). Exploitation requires either an...