CVE-2026-37737

Katalog CVE

CVSS 6.5 · Medium EPSS 0,24%

Kerentanan Origin Validation Error. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain unauthorized access to cross-origin requests for authenticated resources.

Rincian

Terbit di NVD

5 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error
CWE-625: Permissive Regular Expression

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/ashleysommer/sanic-cors
• https://github.com/ashleysommer/sanic-cors/blob/master/sanic_cors/core.py
• https://github.com/npbhatter17/security-advisories/blob/main/CVE-2026-37737-sanic-cors-advisory.md
• https://pypi.org/project/Sanic-Cors/