CVE-2021-23393

This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.

• CWE-601

• https://github.com/briancappello/flask-unchained/commit/71e36b28166f9ffbe0a991f51127f0984f7e6a40Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-PYTHON-FLASKUNCHAINED-1293189Patch, Third Party Advisory
• https://github.com/briancappello/flask-unchained/commit/71e36b28166f9ffbe0a991f51127f0984f7e6a40Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-PYTHON-FLASKUNCHAINED-1293189Patch, Third Party Advisory

Published

Jun 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23388The package forms before 1.2.1, from 1.3.0 and before 1.3.2 …5.3
• CVE-2021-23389The package total.js before 3.4.9 are vulnerable to Arbitrar…9.8
• CVE-2021-2339Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23390The package total4 before 0.0.43 are vulnerable to Arbitrary…9.8
• CVE-2021-23391This affects all versions of package calipso. It is possible…7.1
• CVE-2021-23392The package locutus before 2.0.15 are vulnerable to Regular …7.5
• CVE-2021-23394The package studio-42/elfinder before 2.1.58 are vulnerable …9.8
• CVE-2021-23395This affects all versions of package nedb. The library could…5.3
• CVE-2021-23396All versions of package lutils are vulnerable to Prototype P…9.8
• CVE-2021-23397All versions of package @ianwalter/merge are vulnerable to P…9.8
• CVE-2021-23398All versions of package react-bootstrap-table are vulnerable…6.1
• CVE-2021-23399This affects all versions of package wincred. If attacker-co…9.8