PYSEC-2026-3539
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/sanic-cors/PYSEC-2026-3539.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-3539
- Aliases
-
- CVE-2026-37737
- GHSA-94jw-hqvj-vw74
- Published
- 2026-07-23T11:41:39.408627Z
- Modified
- 2026-07-23T15:00:23.754390138Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- sanic-cors contains an improper regular expression in the try_match() function
- Details
-
sanic-cors version 2.2.0 and prior contains an improper regular expression in the trymatch() function in saniccors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain unauthorized access to cross-origin requests for authenticated resources.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2026-37737
- https://github.com/ashleysommer/sanic-cors
- https://github.com/ashleysommer/sanic-cors/blob/master/sanic_cors/core.py
- https://github.com/npbhatter17/security-advisories/blob/main/CVE-2026-37737-sanic-cors-advisory.md
- https://pypi.org/project/Sanic-Cors
- https://pypi.org/project/sanic-cors
- https://github.com/advisories/GHSA-94jw-hqvj-vw74
Affected packages
PyPI / sanic-cors
Package
- Name
- sanic-cors
- View open source insights on deps.dev
- Purl
- pkg:pypi/sanic-cors
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedLast affected2.2.0
Affected versions
0.*
0.4.1
0.4.1.2
0.4.1.4
0.5.1.0
0.5.4.1
0.5.4.2
0.6.0.0
0.6.0.1
0.6.0.2
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.8.post1
0.9.8.post2
0.9.8.post3
0.9.9
0.9.9.post1
0.9.9.post2
0.9.9.post3
0.9.9.post4
0.10.0b1
0.10.0
0.10.0.post1
0.10.0.post2
0.10.0.post3
1.*
1.0.0
1.0.1
2.*
2.0.0
2.0.1
2.1.0
2.2.0b1
2.2.0