Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.4epss 0.4%
probabilidad de explotación
0.4%top 66% de las CVE
explotación observada
noninguna fuente lo reporta
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built from configured allowlist values and used with fullmatch() for validation. Because metacharacters are not escaped, a malicious origin can match unexpectedly. The check relies on allowed_origins_regex.fullmatch(origin). This vulnerability is fixed in 2.20.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Productos afectados
litestar-org · litestarReferencias
https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0https://github.com/litestar-org/litestar/commit/eb87703b309efcc0d1b087dcb12784e76b003d5ahttps://github.com/litestar-org/litestar/releases/tag/v2.20.0https://github.com/litestar-org/litestar/security/advisories/GHSA-2p2x-hpg8-cqp2