Malicious Code Exfiltration in Flaask Package
Summary
MAL-2025-192945: Malicious code in flaask (PyPI). Affects flaask versions 0.0.1 – 0.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flaask is a Python package available on PyPI, designed for web development and related functionalities. However, it has been compromised, leading to the inclusion of malicious code that exfiltrates sensitive information from the host system. The package has versions 0.0.1 to 0.0.4, all of which are affected by this vulnerability.
Vulnerability Detail
The vulnerability originates from a malicious actor, identified as kam193, who has embedded code within the Flaask package that exfiltrates basic information about the host system, such as the IP address and username. This code is executed during the installation process due to the package overriding the install command in setup.py. The risk associated with this vulnerability is limited, but it poses a significant threat to user privacy and data security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall flaaskIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid installing the Flaask package until a patched version is released. Additionally, consider using alternative packages that provide similar functionalities without the associated risks.
Conclusion
The Flaask package has been compromised to include malicious code that exfiltrates sensitive information from users' systems. It is crucial for users to uninstall the affected versions and refrain from using the package until a secure update is available. Monitoring tools like Vulert can help keep track of vulnerabilities in your software.
See every vulnerability recorded for flaask →
FAQ
Flaask is a Python package intended for web development, but it has been compromised to include malicious code.
The vulnerability allows the package to exfiltrate sensitive information such as your IP address and username during installation.
You should uninstall the Flaask package immediately using the command: pip uninstall flaask.
Currently, there are no patched versions of Flaask available. It is recommended to avoid using this package until a safe version is released.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using Pipfile.lock. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
