CVE-2024-34069: Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-06 · updated 2026-06-17
Weakness: CWE-352

Description

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.

Affected products

Debian Linux: 11.0
Fedoraproject Fedora: 38, 40
pallets werkzeug: before 3.0.3 — fixed in 3.0.3
Pypi Werkzeug: before 3.0.3; 0.1, 0.10, 0.10.1, 0.10.2, 0.10.3, 0.10.4 (+87) — fixed in 3.0.3

How to fix

Upgrade to a fixed version: pallets werkzeug 3.0.3; Pypi Werkzeug 3.0.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-34069 or the next vulnerability affects your stack