EUVD-2026-34844
GHSA-94jw-hqvj-vw74
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain unauthorized access to cross-origin requests for authenticated resources.
AnalysisAI
CORS origin allowlist bypass in sanic-cors 2.2.0 and prior enables cross-origin access to authenticated resources by exploiting an unanchored regular expression in the origin-matching logic. The library's try_match() function in sanic_cors/core.py uses Python's re.match() - which matches only from the start of a string, not the full string - allowing an attacker who controls a domain prefixed with a trusted origin (e.g., trusted.example.com.attacker.com) to satisfy the allowlist check. Exploitation requires a victim user to visit an attacker-controlled page, placing this in a network-accessible, user-interaction-required threat model. No public exploit code has been identified at time of analysis, and no KEV listing exists.
Technical ContextAI
sanic-cors is the CORS middleware library for the Sanic async Python web framework, analogous to flask-cors or django-cors-headers. CORS enforcement depends on accurately matching the incoming Origin header against a server-configured allowlist. The root cause is CWE-346 (Origin Validation Error): the try_match() function at sanic_cors/core.py uses Python's re.match(), which anchors only at the beginning of a string. When an allowlist entry such as 'https://trusted.example.com' is compiled as a pattern and matched via re.match(), the string 'https://trusted.example.com.attacker.com' satisfies the match because re.match() returns a match object for any input that starts with the pattern. The correct fix is re.fullmatch() or appending a '$' end anchor. Affected versions are 2.2.0 and all prior releases; CPE data in NVD is currently listed as n/a, meaning no machine-readable product identifier has been assigned yet.
RemediationAI
No vendor-released patch has been identified at time of analysis. Defenders should monitor the upstream repository at https://github.com/ashleysommer/sanic-cors and the PyPI package at https://pypi.org/project/Sanic-Cors/ for a fix release. As a compensating control, application owners can manually patch the try_match() function in their local installation by replacing re.match(pattern, origin) with re.fullmatch(pattern, origin), or by appending a '$' end anchor to all origin patterns before compilation - this ensures the full origin string is matched. Trade-off: this manual patch will be overwritten on package upgrade and requires re-application. Additionally, if the application allows wildcard or prefix-style origin patterns in its CORS configuration, tighten these to exact-string literals where possible, reducing reliance on regex matching altogether. Review whether CORS is functioning as an actual security boundary in the application; if sensitive authenticated endpoints rely solely on CORS enforcement without additional access controls (e.g., CSRF tokens, Authorization headers), add those controls as defense-in-depth.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today