Unfurl versions through 2025.08 contain an input validation flaw in configuration parsing. The debug mode setting is interpreted as a string and directly passed to Flask’s app.run() without proper type checking. Because any non‑empty string evaluates as true, a malicious configuration can activate debug mode. This allows an attacker to access the Werkzeug debugger, view sensitive data, or execute arbitrary code on the host.

The vulnerability affects ObsidianForensics’ Unfurl product up to and including the 2025.08 release. No other vendors or products are listed, and affected versions are those that use the default configuration parsing path described.

The flaw carries a CVSS score of 9.3 and is not present in the CISA KEV catalog. Exploitation requires an attacker who can supply or influence configuration contents, which may be achieved remotely if configuration files are exposed, or locally if an attacker has filesystem access. The severity is high and the likelihood of exploitation is significant given the ease of enabling debug mode through any non‑empty string.