---
title: "GHSA-vg9h-jx4v-cwx2: Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)"
url: https://erroneo.us/security/ghsa/GHSA-vg9h-jx4v-cwx2/
description: "GHSA-vg9h-jx4v-cwx2 (critical, PyPI): Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure). Summary The Unfurl…"
type: advisory
section: "Security Digest"
date_published: 2026-01-29
date_modified: 2026-01-29
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-vg9h-jx4v-cwx2"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-vg9h-jx4v-cwx2: Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)

## Affected packages

- PyPI `dfir-unfurl` <= 20250810 → fixed: none listed

## Details

Summary The Unfurl web app enables Flask debug mode even when configuration sets debug = False. The config value is read as a string and passed directly to app.run(debug=...), so any non-empty string evaluates truthy. This leaves the Werkzeug debugger active by default. Details - unfurl/app.py:webapp() reads debug via config['UNFURLAPP'].get('debug'), which returns a string. - UnfurlApp.init passes that string directly to app.run(debug=unfurldebug, ...). - If unfurl.ini omits debug, the default argument is the string "True". - As a result, debug mode is effectively always on and cannot be reliably disabled via config. PoC 1. Create a local unfurl.ini with debug = False under [UNFURLAPP]. 2. Run the server using unfurlapp (or python -c 'from unfurl.app import webapp; webapp()'). 3. Observe server logs showing Debug mode: on / Debugger is active!. 4. The included PoC script securitypoc/pocdebugmode.py --spawn automates this check. PoC Script (inline) Impact If the service is exposed beyond localhost (bound to 0.0.0.0 or reverse-proxied), an attacker can access the Werkzeug debugger. This can disclose sensitive information and may allow remote code execution if a debugger PIN is obtained. At minimum, stack traces and environment details are exposed on errors.

## Sources

- [GitHub Advisory GHSA-vg9h-jx4v-cwx2](https://github.com/advisories/GHSA-vg9h-jx4v-cwx2)
- [github.com](https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-vg9h-jx4v-cwx2)
- [github.com](https://github.com/obsidianforensics/unfurl/commit/4c0a07ab1e9af3a1ddf0e7f47153ec9ba77946dd)

---
Source page: https://erroneo.us/security/ghsa/GHSA-vg9h-jx4v-cwx2/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt