CVE-2026-33057: Python Flask Request Code Execution

Untrusted HTTP request data flows into a Python code-execution sink (exec/eval/runpy/importlib/__import__/compile or a custom execute_module helper). A web endpoint that evaluates request-supplied Python source — even after base64 decoding or writing to disk first — yields unauthenticated Remote Code Execution. Require authentication, drop the endpoint, or n

Provally CuratedPublic repositoryHighHigh confidenceVerifiedApache-2.0Python
greprules fetch cve-2026-33057-python-flask-request-code-execution --engine opengrep

Description

Untrusted HTTP request data flows into a Python code-execution sink (exec/eval/runpy/importlib/__import__/compile or a custom execute_module helper). A web endpoint that evaluates request-supplied Python source — even after base64 decoding or writing to disk first — yields unauthenticated Remote Code Execution. Require authentication, drop the endpoint, or n