Dear Maintainer,

running the following command:

onionshare-cli --chat

then connecting to the .onion link it outputs with the key it outputs, then trying to type in the chat window gives the following error message and fails to display the connection message or the typed chat message, rendering the chat functionality completely unusable. share and receive seem unaffected so far as i can discern - only chat is obviously broken

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/engineio/server.py", line 450, in run_handler
    return self.handlers[event](*args)
           ~~~~~~~~~~~~~~~~~~~~^^^^^^^
  File "/usr/lib/python3/dist-packages/socketio/server.py", line 652, in _handle_eio_message
    self._handle_connect(eio_sid, pkt.namespace, pkt.data)
    ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/socketio/server.py", line 538, in _handle_connect
    success = self._trigger_event(
        'connect', namespace, sid, self.environ[eio_sid])
  File "/usr/lib/python3/dist-packages/socketio/server.py", line 617, in _trigger_event
    return handler(*args)
  File "/usr/lib/python3/dist-packages/flask_socketio/__init__.py", line 292, in _handler
    return self._handle_event(handler, message, real_ns, sid,
           ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                              *args)
                              ^^^^^^
  File "/usr/lib/python3/dist-packages/flask_socketio/__init__.py", line 816, in _handle_event
    ctx.session = session_obj
    ^^^^^^^^^^^
AttributeError: property 'session' of 'RequestContext' object has no setter

Hey,

this is an issue in flask/flask-socketio an not in onionshare itself.

And was introduced by fixing  CVE-2026-27205 within flask by backport:
https://sources.debian.org/src/flask/3.1.1-1%2Bdeb13u1/debian/patches/
CVE-2026-27205-request-context-tracks-session-access.patch

The problem is, that a commit from 3.1.3 got backported, that changes the API
of flask, that is used by flask-socketio. With the fix for CVE-2026-27205 it
would need to write to _session. flask-socketio has fixed that with 5.6.1. The
relevant hunk is:
https://github.com/miguelgrinberg/Flask-SocketIO/commit/
956f8f2847c53d5156620b395912b7c916e15a1b#diff-
d4032ca32e5dce64b1e46683f4bc8544ccefadb6e8f3e09a62152dda9c0a0578L815

This issue was reported two times already for unstable with
flask-socketio < 5.6 and  flask > 3.1.1:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132356
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136892

How we now do a follow-up? We actually need a pu for flask-socketio, or any
other ideas?

Regards,

hefee

Hey,

The patch to fix CVE-2026-27205 changed API of Flask. So flask-socketio cannot
be used within onionshare :( The detailed analysis you find at my former
response.

I prepared a proposed-update for Trixie, the debdiff is attached or you can
look at the created merge request:
https://salsa.debian.org/debian/python-flask-socketio/-/merge_requests/3

Regards,

hefee