CVE-2026-25478
High · 7.4CVSS
7.4
EPSS
0.5%
Published
Feb 9, 2026
CISA due date
—
The record
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built from configured allowlist values and used with fullmatch() for validation. Because metacharacters are not escaped, a malicious origin can match unexpectedly. The check relies on allowed_origins_regex.fullmatch(origin). This vulnerability is fixed in 2.20.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | litestar | 2.19.0 | 2.20.0 |
Related vulnerabilities
- GHSA-2p2x-hpg8-cqp2 Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in… Same vulnerability
- CVE-2026-25479 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Also affects litestar
- CVE-2026-25480 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Also affects litestar
- GHSA-vxqx-rh46-q2pg Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning… Also affects litestar
- GHSA-93ph-p7v4-hwh4 Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in… Also affects litestar
- CVE-2026-53649 Joro is a web exploitation framework. CWE-942
- CVE-2025-61163 Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain… CWE-942
- CVE-2026-63407 Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your… CWE-942