flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is…
Priority LOW 39CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.
Summary
flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made across domains, leading to CSRF.
Why it matters now
EPSS 0.00606 49th percentileScored 2026-11-07
Fix Fixed webargs (PyPI): 5.5.3, 6.0.0b4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | webargs (PyPI) | 5.0.0 to before 5.5.3 | 5.5.3 | Patch available | GHSA-fjq3-5pxw-4wj4 |
| — | webargs (PyPI) | 6.0.0b1 to before 6.0.0b4 | 6.0.0b4 | Patch available | GHSA-fjq3-5pxw-4wj4 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- webargs (PyPI) Vendor— Affected 5.0.0 to before 5.5.3 Fixed in 5.5.3 Patch available GHSA-fjq3-5pxw-4wj4
- webargs (PyPI) Vendor— Affected 6.0.0b1 to before 6.0.0b4 Fixed in 6.0.0b4 Patch available GHSA-fjq3-5pxw-4wj4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:webargs_project:webargs:*:*:*:*:*:*:*:* | 5.0.0 – 5.5.2 | Vulnerable | Webargs Project |
- cpe:2.3:a:webargs_project:webargs:*:*:*:*:*:*:*:* Versions 5.0.0 – 5.5.2 Vulnerable ·Webargs Project
Remediation
- Fix · GHSA-fjq3-5pxw-4wj4 webargs (PyPI) Fixed in 5.5.3 Advisory →
- Fix · GHSA-fjq3-5pxw-4wj4 webargs (PyPI) Fixed in 6.0.0b4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7965
- 2026-10-03 Alias added: GHSA-fjq3-5pxw-4wj4
References
Advisory 2
Other 5
- https://github.com/marshmallow-code/webargs/commit/b9ee8b0aa668207a363d9fd21d967eeadb975c3e
- https://github.com/marshmallow-code/webargs
- https://github.com/pypa/advisory-database/tree/main/vulns/webargs/PYSEC-2020-156.yaml
- https://webargs.readthedocs.io/en/latest/changelog.html#b4-2020-01-28
- https://webargs.readthedocs.io/en/latest/changelog.html#id11
More Webargs Project Webargs vulnerabilities
- TI-2019-07108 An issue was discovered in webargs before 5.1.3, as used with marshmallow and other… CVSS 3.0HIGH 8.1
Sources
- CVE-2020-7965 · CVE Program
- CVE-2020-7965 · NVD
- FIRST EPSS
- GHSA-fjq3-5pxw-4wj4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences