# CVE-2024-1681: corydolphin flask-cors log injection in debug mode

Source: https://junglewise.ai/threats/cve-2024-1681-corydolphin-flask-cors-log-injection-in-debug-mode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-04-19. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2024-1681 · Severity: medium · CVSS 5.3 · Published 2024-04-19

A vulnerability in the flask-cors library, which manages Cross-Origin Resource Sharing (CORS) for Flask applications, allows attackers to inject fake entries into system logs. By sending specially crafted web requests, an attacker can create misleading log data to hide malicious activity or disrupt automated log monitoring tools. This issue primarily affects systems where debug-level logging is enabled.

Technologies: [Flask-Cors (PyPI)](https://junglewise.ai/threats/technologies/flask-cors). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-1681 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-1681 being exploited in the wild.

**How severe is CVE-2024-1681?** Medium severity, with a CVSS score of 5.3, published 19 April 2024.

**Which products and versions are affected?** Flask-Cors (PyPI) <= 4.0.0, ECOSYSTEM:introduced=0,fixed=4.0.1, ECOSYSTEM:introduced=0,last_affected=4.0.0.

**Is there a fix for CVE-2024-1681?** Yes. Flask-Cors (PyPI): upgrade to 4.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-1681 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-1681?** Check whether you run Flask-Cors (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Flask-Cors (PyPI): upgrade to 4.0.1 or later

  ```sh
  pip install "Flask-Cors>=4.0.1"
  ```


## Technical details

The flask-cors library (versions 4.0.0 and prior) is vulnerable to log injection (CWE-117) due to improper output neutralization of user-supplied input before it is written to logs. When the application's log level is set to DEBUG, an unauthenticated remote attacker can send a GET request containing Carriage Return and Line Feed (CRLF) sequences in the request path. This allows the attacker to terminate the current log line and start a new, forged entry. This can be used to bypass log integrity, mislead forensic investigations, or exploit vulnerabilities in log processing software. The issue is patched in version 4.0.1.

## Affected products

- corydolphin flask-cors <= 4.0.0

## Identifiers

- CVE-2024-1681
- GHSA-84pr-m4jr-85g5
- PYSEC-2024-271

## Timeline

- 2024-04-19: disclosed
- 2024-04-19: advisory: GHSA-84pr-m4jr-85g5 published

## References

- [https://api.github.com/users/bayandin](https://api.github.com/users/bayandin)
- [https://github.com/bayandin](https://github.com/bayandin)
- [https://api.github.com/users/bayandin/gists%7B/gist_id%7D](https://api.github.com/users/bayandin/gists%7B/gist_id%7D)
- [https://api.github.com/users/bayandin/repos](https://api.github.com/users/bayandin/repos)
- [https://avatars.githubusercontent.com/u/864213?v=4](https://avatars.githubusercontent.com/u/864213?v=4)
- [https://api.github.com/users/bayandin/events%7B/privacy%7D](https://api.github.com/users/bayandin/events%7B/privacy%7D)

## Related threats

- [PYSEC-2026-1385 - Flask-CORS allows for inconsistent CORS matching](https://junglewise.ai/threats/cve-2024-6844-flask-cors-allows-for-inconsistent-cors-matching)
- [PYSEC-2026-1384 - Flask-CORS improper regex path matching vulnerability](https://junglewise.ai/threats/cve-2024-6839-flask-cors-improper-regex-path-matching-vulnerability)
- [PYSEC-2026-1383 - Flask-CORS vulnerable to Improper Handling of Case Sensitivity](https://junglewise.ai/threats/cve-2024-6866-flask-cors-vulnerable-to-improper-handling-of-case-sensitivity)
- [Flask-Cors improper access control in Private Network Access header](https://junglewise.ai/threats/cve-2024-6221-flask-cors-improper-access-control-in-private-network-access)
- [Flask-Cors Directory Traversal vulnerability](https://junglewise.ai/threats/cve-2020-25032-flask-cors-directory-traversal-vulnerability)