GHSA-2p2x-hpg8-cqp2
High · 7.4CVSS
7.4
EPSS
—
Published
Feb 9, 2026
CISA due date
—
The record
Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | litestar | 2.19.0 | 2.20.0 |
Related vulnerabilities
- CVE-2026-25478 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Same vulnerability
- CVE-2026-25479 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Also affects litestar
- CVE-2026-25480 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Also affects litestar
- GHSA-vxqx-rh46-q2pg Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning… Also affects litestar
- GHSA-93ph-p7v4-hwh4 Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in… Also affects litestar
- CVE-2026-53649 Joro is a web exploitation framework. CWE-942
- CVE-2025-61163 Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain… CWE-942
- CVE-2026-63407 Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your… CWE-942