GHSA-94jw-hqvj-vw74

Suggest an improvement
Source
https://github.com/advisories/GHSA-94jw-hqvj-vw74
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-94jw-hqvj-vw74/GHSA-94jw-hqvj-vw74.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-94jw-hqvj-vw74
Aliases
Published
2026-06-05T15:32:25Z
Modified
2026-07-23T15:11:37Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
sanic-cors contains an improper regular expression in the try_match() function
Details

sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain unauthorized access to cross-origin requests for authenticated resources.

Database specific 
{
    "cwe_ids":  [
        "CWE-346"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-17T17:05:30Z",
    "nvd_published_at":  "2026-06-05T15:16:51Z",
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / sanic-cors

Package

Name
sanic-cors
View open source insights on deps.dev
Purl
pkg:pypi/sanic-cors

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
2.2.0

Affected versions

0.*
0.4.1
0.4.1.2
0.4.1.4
0.5.1.0
0.5.4.1
0.5.4.2
0.6.0.0
0.6.0.1
0.6.0.2
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.8.post1
0.9.8.post2
0.9.8.post3
0.9.9
0.9.9.post1
0.9.9.post2
0.9.9.post3
0.9.9.post4
0.10.0b1
0.10.0
0.10.0.post1
0.10.0.post2
0.10.0.post3
1.*
1.0.0
1.0.1
2.*
2.0.0
2.0.1
2.1.0
2.2.0b1
2.2.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-94jw-hqvj-vw74/GHSA-94jw-hqvj-vw74.json"