CVE-2024-34069High· 7.5▾ MidnightPoC availableWerkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.7 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
3.4%
Metasploit ×1
Last analysed / modified upstream
The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger.
werkzeug < 3.0.3Upgrade to a patched release:
werkzeug 3.0.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-46136Medium· 5.7Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
CVE-2026-27199MediumWerkzeug safe_join() allows Windows special device names
CVE-2019-14322High· 7.5Pallets Werkzeug vulnerable to Path Traversal
CVE-2023-25577High· 7.5High resource usage when parsing multipart form data with many fields
CVE-2023-23934Low· 2.6Incorrect parsing of nameless cookies leads to __Host- cookies bypass
CVE-2024-49767High· 7.5Werkzeug possible resource exhaustion when parsing file data in forms