pallets/flask free scan: 9 vulnerable dependencies, 0 committed secrets

pallets/flask ↗ · d318b68 · Aug 21, 2026, 10:53 PM

No issues found

Free scan · deterministic evidence only

No deterministic issues found — not a clean bill of health. 14 dimensions remain unaudited. Run Audit for the verdict.

142 of 236 files scanned (60%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.

What this means

Two scanners read 142 of 236 files: one for committed credentials, one for known vulnerabilities in your dependencies. Neither found anything. That is not a clean bill of health. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.

Read it:

Worth knowing, not blocking

9 found · 4 packages · 9 devDependencies

Context only — test/example secrets, dev-only or moderate/low CVEs. Never verdict-forcing.

dev depPyPI jinja23 in 1 version

3.1.2 — GHSA-cpwx-vrp4-4pq7, GHSA-gmj6-6f8f-6699, GHSA-h5c8-rqwp-cp95

Jinja2 vulnerable to sandbox breakout through attr filter selecting format method — devDependency

Jinja has a sandbox breakout through malicious filenames — devDependency

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter — devDependency

dev depPyPI werkzeug3 in 1 version

2.3.3 — GHSA-29vq-49wr-vm6x, GHSA-2g68-c3qc-8985, GHSA-87hc-h4r5-73f7

Werkzeug safe_join() allows Windows special device names — devDependency

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain — devDependency

Werkzeug safe_join() allows Windows special device names with compound extensions — devDependency

dev depPyPI flask2 in 1 version

2.3.2 — GHSA-68rp-wp8r-4726, PYSEC-2026-2151

Flask session does not add `Vary: Cookie` header when accessed in some ways — devDependency

Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Us — devDependency

dev depPyPI click@8.1.3PYSEC-2026-2132

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account. — devDependency

AI audit · pallets/flask · 14 dimensions · usually within 15 minutes*

Audit — your first Audit is free. After that, about $5.Needs a free GitHub or Google sign-inThe free scan stays unlimited

14 things unaudited

Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.

The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.

SecurityPriority: Core

Privacy & CompliancePriority: Core

Reliability & ResiliencePriority: Core

Code Quality & ArchitecturePriority: Important

AI / Vibe Coding RiskPriority: Important

Performance & ScalabilityPriority: Important

Infrastructure & DevOpsPriority: Important

Data LayerPriority: Important

Business & Product RiskPriority: Supporting

Developer ExperiencePriority: Supporting

Accessibility & UXPriority: Supporting

ObservabilityPriority: Supporting

Maintainability ForecastPriority: Specialized

IP & Novelty ExposurePriority: Specialized

Modules run (2)

Hardcoded Secret ScanDependency Vulnerability Scan

Hover a module for why it was selected. See every check nittim can run.

Scanned 142 of 236 files · pallets/flask
Dependency manifests: 5 Python manifests read.

README badge

[![nittim](https://nittim.com/api/badge/pallets/flask)](https://nittim.com/library/pallets/flask)