Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl: 6 vulnerabilities (highest severity is: 7.5)

[mend-bolt-for-github]

Vulnerable Library - Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl

Path to dependency file: /Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (Flask_JWT_Extended version)	Remediation Possible**
CVE-2026-32597	High	7.5	PyJWT-2.8.0-py3-none-any.whl	Transitive	N/A*	❌
CVE-2024-34069	High	7.5	werkzeug-3.0.1-py3-none-any.whl	Transitive	4.7.0	❌
CVE-2026-27199	Medium	5.3	werkzeug-3.0.1-py3-none-any.whl	Transitive	N/A*	❌
CVE-2026-21860	Medium	5.3	werkzeug-3.0.1-py3-none-any.whl	Transitive	4.7.0	❌
CVE-2025-66221	Medium	5.3	werkzeug-3.0.1-py3-none-any.whl	Transitive	4.7.0	❌
CVE-2024-49766	Low	3.7	werkzeug-3.0.1-py3-none-any.whl	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-32597

Vulnerable Library - PyJWT-2.8.0-py3-none-any.whl

JSON Web Token implementation in Python

Library home page: https://files.pythonhosted.org/packages/2b/4f/e04a8067c7c96c364cef7ef73906504e2f40d690811c021e1a1901473a19/PyJWT-2.8.0-py3-none-any.whl

Path to dependency file: /Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/PyJWT-2.8.0.dist-info

Dependency Hierarchy:

• Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
  • ❌ PyJWT-2.8.0-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.

Publish Date: 2026-03-12

URL: CVE-2026-32597

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-752w-5fwx-jx9f

Release Date: 2026-03-12

Fix Resolution: pyjwt - 2.12.0

Step up your Open Source Security Game with Mend here

CVE-2024-34069

Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl

Path to dependency file: /Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info

Dependency Hierarchy:

• Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
  • ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.

Publish Date: 2024-05-06

URL: CVE-2024-34069

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2g68-c3qc-8985

Release Date: 2024-05-06

Fix Resolution (Werkzeug): 3.0.3

Direct dependency fix Resolution (Flask-JWT-Extended): 4.7.0

Step up your Open Source Security Game with Mend here

CVE-2026-27199

Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl

Path to dependency file: /Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info

Dependency Hierarchy:

• Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
  • ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been fixed in version 3.1.6.

Publish Date: 2026-02-21

URL: CVE-2026-27199

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-02-21

Fix Resolution: werkzeug - 3.1.6,https://github.com/pallets/werkzeug.git - 3.1.6

Step up your Open Source Security Game with Mend here

CVE-2026-21860

Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl

Path to dependency file: /Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info

Dependency Hierarchy:

• Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
  • ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5.

Publish Date: 2026-01-08

URL: CVE-2026-21860

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-87hc-h4r5-73f7

Release Date: 2026-01-08

Fix Resolution (Werkzeug): 3.1.5

Direct dependency fix Resolution (Flask-JWT-Extended): 4.7.0

Step up your Open Source Security Game with Mend here

CVE-2025-66221

Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl

Path to dependency file: /Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info

Dependency Hierarchy:

• Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
  • ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.

Publish Date: 2025-11-29

URL: CVE-2025-66221

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-11-29

Fix Resolution (Werkzeug): 3.1.4

Direct dependency fix Resolution (Flask-JWT-Extended): 4.7.0

Step up your Open Source Security Game with Mend here

CVE-2024-49766

Vulnerable Library - werkzeug-3.0.1-py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/c3/fc/254c3e9b5feb89ff5b9076a23218dafbc99c96ac5941e900b71206e6313b/werkzeug-3.0.1-py3-none-any.whl

Path to dependency file: /Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/reactresolve-_UixkESs/lib/python3.8/site-packages/werkzeug-3.0.1.dist-info

Dependency Hierarchy:

• Flask_JWT_Extended-4.6.0-py2.py3-none-any.whl (Root Library)
  • ❌ werkzeug-3.0.1-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.

Publish Date: 2024-10-25

URL: CVE-2024-49766

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f9vj-2wh5-fj8j

Release Date: 2024-10-25

Fix Resolution: Werkzeug - 3.0.6

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-bolt-for-github]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.