Scan report

pallets / flask

View on GitHub (opens in a new tab)
Python
74745 stars
Scanned 17 Sep 2026, 08:42

Report Rescan

Vulnerability Low

Could an attacker exploit mistakes in this code?

18 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 9
Low: 7

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

2 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 1
Low: 7

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

24 total findings

Likely real: 5
Uncertain: 7
Likely noise: 12

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has a low overall vulnerability score of 18.0, which means that while there are some coding patterns that could be exploited by an attacker, the code itself does not appear to be intentionally malicious. The most serious issues involve using unescaped HTML content and relying on unsafe functions like eval() and exec(), which can lead to cross-site scripting or code injection if input from outside the program is used. These findings are consistent with standard insecure coding practices rather than signs of a hidden attack, but they do require immediate attention because they represent real security risks that could be exploited by an attacker. Additionally, there are several dependencies with loose version constraints and one SHA1 hash algorithm that should be updated to improve stability and reduce potential supply chain issues.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Bandit 11

Python security linter · Vulnerability
Dependency checker 8

CVEs, typosquats and risky installs · Supply chain
Semgrep 5

Pattern-based code analysis · Vulnerability

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/flask/json/tag.py line 188

Likely real
Yes, 100% confidence

Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
```
return Markup(value)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/pyproject.toml line 103

Likely real
Yes, 99% confidence

This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns
```
[tool.uv]
default-groups = ["dev", "pre-commit", "tests", "typing"]
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/flask/json/tag.py line 188

Likely real
Yes, 98% confidence

Potential XSS with ``markupsafe.Markup`` detected. Do not use ``Markup`` on untrusted data.
```
187     def to_python(self, value: t.Any) -> t.Any:
188         return Markup(value)
189
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Yes, 54% confidence

Unpinned dependency: 'python-dotenv' has no version lock — supply chain risk
```
python-dotenv
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/flask/sessions.py line 281

Likely real
Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
```
return hashlib.sha1(string)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/flask/config.py line 209

Likely real
Uncertain, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
```
exec(compile(config_file.read(), filename, "exec"), d.__dict__)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/flask/cli.py line 1023

Likely real
Uncertain, 49% confidence

Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
```
eval(compile(f.read(), startup, "exec"), ctx)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/flask/sessions.py line 281

Likely real
Uncertain, 47% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False
```
280     """
281     return hashlib.sha1(string)
282
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/flask/cli.py line 1023

Likely real
Uncertain, 41% confidence

Use of possibly insecure function - consider using safer ast.literal_eval.
```
1022         with open(startup) as f:
1023             eval(compile(f.read(), startup, "exec"), ctx)
1024
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/flask/config.py line 209

Likely real
Uncertain, 40% confidence

Use of exec detected.
```
208             with open(filename, mode="rb") as config_file:
209                 exec(compile(config_file.read(), filename, "exec"), d.__dict__)
210         except OSError as e:
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /src/flask/app.py line 213
Likely real: Uncertain, 45% confidence

Possible hardcoded password: 'None'

212             "SECRET_KEY": None,
213             "SECRET_KEY_FALLBACKS": None,
214             "PERMANENT_SESSION_LIFETIME": timedelta(days=31),
215             "USE_X_SENDFILE": False,
216             "TRUSTED_HOSTS": None,
217             "SERVER_NAME": None,
218             "APPLICATION_ROOT": "/",
219             "SESSION_COOKIE_NAME": "session",
220             "SESSION_COOKIE_DOMAIN": None,
221             "SESSION_COOKIE_PATH": None,
222             "SESSION_COOKIE_HTTPONLY": True,
223             "SESSION_COOKIE_SECURE": False,
224             "SESSION_COOKIE_PARTITIONED": False,
225             "SESSION_COOKIE_SAMESITE": None,
226             "SESSION_REFRESH_EACH_REQUEST": True,
227             "MAX_CONTENT_LENGTH": None,
228             "MAX_FORM_MEMORY_SIZE": 500_000,
229             "MAX_FORM_PARTS": 1_000,
230             "SEND_FILE_MAX_AGE_DEFAULT": None,
231             "TRAP_BAD_REQUEST_ERRORS": None,
232             "TRAP_HTTP_EXCEPTIONS": False,
233             "EXPLAIN_TEMPLATE_LOADING": False,
234             "PREFERRED_URL_SCHEME": "http",
235             "TEMPLATES_AUTO_RELOAD": None,
236             "MAX_COOKIE_SIZE": 4093,
237             "PROVIDE_AUTOMATIC_OPTIONS": True,
238         }
239     )
240 
241     #: The class that is used for request objects.  See :class:`~flask.Request`
242     #: for more information.
243     request_class: type[Request] = Request
244

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /src/flask/app.py line 212
Likely real: Uncertain, 45% confidence

Possible hardcoded password: 'None'

211             "PROPAGATE_EXCEPTIONS": None,
212             "SECRET_KEY": None,
213             "SECRET_KEY_FALLBACKS": None,
214             "PERMANENT_SESSION_LIFETIME": timedelta(days=31),
215             "USE_X_SENDFILE": False,
216             "TRUSTED_HOSTS": None,
217             "SERVER_NAME": None,
218             "APPLICATION_ROOT": "/",
219             "SESSION_COOKIE_NAME": "session",
220             "SESSION_COOKIE_DOMAIN": None,
221             "SESSION_COOKIE_PATH": None,
222             "SESSION_COOKIE_HTTPONLY": True,
223             "SESSION_COOKIE_SECURE": False,
224             "SESSION_COOKIE_PARTITIONED": False,
225             "SESSION_COOKIE_SAMESITE": None,
226             "SESSION_REFRESH_EACH_REQUEST": True,
227             "MAX_CONTENT_LENGTH": None,
228             "MAX_FORM_MEMORY_SIZE": 500_000,
229             "MAX_FORM_PARTS": 1_000,
230             "SEND_FILE_MAX_AGE_DEFAULT": None,
231             "TRAP_BAD_REQUEST_ERRORS": None,
232             "TRAP_HTTP_EXCEPTIONS": False,
233             "EXPLAIN_TEMPLATE_LOADING": False,
234             "PREFERRED_URL_SCHEME": "http",
235             "TEMPLATES_AUTO_RELOAD": None,
236             "MAX_COOKIE_SIZE": 4093,
237             "PROVIDE_AUTOMATIC_OPTIONS": True,
238         }
239     )
240 
241     #: The class that is used for request objects.  See :class:`~flask.Request`
242     #: for more information.
243     request_class: type[Request] = Request

Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'blinker>=1.9.0' — attacker could push malicious update
```
blinker>=1.9.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'click>=8.1.3' — attacker could push malicious update
```
click>=8.1.3
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'itsdangerous>=2.2.0' — attacker could push malicious update
```
itsdangerous>=2.2.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'jinja2>=3.1.2' — attacker could push malicious update
```
jinja2>=3.1.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'markupsafe>=2.1.1' — attacker could push malicious update
```
markupsafe>=2.1.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'werkzeug>=3.1.0' — attacker could push malicious update
```
werkzeug>=3.1.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'asgiref>=3.2' — attacker could push malicious update
```
asgiref>=3.2
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/flask/sansio/scaffold.py line 713

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
712     """
713     assert view_func is not None, "expected view func if endpoint is not provided."
714     return view_func.__name__
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/flask/testing.py line 59

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
58     ) -> None:
59         assert not (base_url or subdomain or url_scheme) or (
60             base_url is not None
61         ) != bool(subdomain or url_scheme), (
62             'Cannot pass "subdomain" or "url_scheme" with "base_url".'
63         )
64
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/flask/views.py line 190

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
189 
190         assert meth is not None, f"Unimplemented method {request.method!r}"
191         return current_app.ensure_sync(meth)(**kwargs)  # type: ignore[no-any-return]
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/flask/debughelpers.py line 59

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
58         exc = request.routing_exception
59         assert isinstance(exc, RequestRedirect)
60         buf = [
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/flask/app.py line 353

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
352         if self.has_static_folder:
353             assert bool(static_host) == host_matching, (
354                 "Invalid static_host/host_matching combination"
355             )
356             # Use a weakref to avoid creating a reference cycle between the app
```