Conversation

Use Flask? Update it, like *now*:

- https://nvd.nist.gov/vuln/detail/CVE-2018-1000656
- https://github.com/pallets/flask/pull/2691/files

If I'm reading this right, you can use an encoding mismatch to trick the JSON decoder into interpreting escaped quotes, etc, as actual punctuation. Think SQL injection, where the JSON decoder is the database engine. Now imagine someone sends:

`name = 'foo", \'is_root\': True, \'junk\': "'`

or similar, and instead of changing their name, you give them root access.