CVE-2024-27083 Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)

What is CVE-2024-27083?

CVE-2024-27083 is a medium-severity cross-site scripting vulnerability in dpgaspar Flask-AppBuilder, published on 28 Feb 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.

Weakness: CWE-79

Which versions are affected by CVE-2024-27083?

3 open source packages ship an affected version, including flask-appbuilder and Flask-AppBuilder. It affects 1 product.

Products include Dpgaspar Flask-Appbuilder.

How do I fix CVE-2024-27083?

Upgrade flask-appbuilder to 4.2.1 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-27083 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-27083 exists.

Other vulnerabilities in dpgaspar Flask-AppBuilder

• CVE-2024-25128 Flask-AppBuilder incorrect authentication when using auth type OpenID Critical 9.1
• CVE-2021-41265 Improper Authentication in Flask-AppBuilder High 8.1
• CVE-2023-29005 No Rate Limiting on Login AUTH DB High 7.5
• CVE-2021-32805 URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder High 7.2
• CVE-2025-58065 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fqxj-46wg-9v84, PYSEC-2026-1381.