Fix CVE-2023-30861 in Flask HIGH
Fix CVE-2023-30861 (secure cookie bypass) in Flask for PyPI. Paste your requirements.txt into PackageFix and get a patched version back — no CLI, no signup.
⚠ Vulnerability
CVE-2023-30861 — secure cookie bypass in Flask. Update to 3.0.3 or later.
Vulnerable Version — requirements.txt
Flask==2.0.0
Fixed Version — requirements.txt
Flask==3.0.3
✓ Fix
Update to 3.0.3 and run pip install -r requirements.txt to apply the fix.
Scan your dependencies now — paste your manifest, get a fixed version back in seconds.
Open PackageFix →No signup · No CLI · No GitHub connection · Runs 100% in your browser
Frequently Asked Questions
What is CVE-2023-30861?
CVE-2023-30861 is a vulnerability in Flask that allows secure cookie bypass. Update to version 3.0.3 or later to fix it.
Is CVE-2023-30861 on the CISA KEV catalog?
Check the live CISA KEV catalog at packagefix.dev — the catalog updates daily and PackageFix always reflects the current status.
How do I fix CVE-2023-30861 in Flask?
Update Flask to version 3.0.3 or later in your requirements.txt. Run pip install -r requirements.txt after updating.
Does CVE-2023-30861 affect all versions of Flask?
Check the OSV advisory for the exact affected version range. PackageFix shows the minimum safe version for your installed version.