PT-2026-46962 · Pypi · Sanic-Cors

Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-37737

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions sanic-cors versions prior to 2.2.1

Description An improper regular expression is used in the try match() function within sanic cors/core.py. The function utilizes re.match without end-anchoring, which allows an attacker to bypass Cross-Origin Resource Sharing (CORS) origin allowlists. By registering a domain that begins with a trusted origin string, an unauthorized actor can gain access to cross-origin requests for authenticated resources.

Recommendations Update sanic-cors to version 2.2.1 or later.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-625

CWE-346

Related Identifiers

CVE-2026-37737

Affected Products

Sanic-Cors

References · 6

• 🔥 https://github.com/npbhatter17/security-advisories/blob/main/CVE-2026-37737-sanic-cors-advisory.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-37737 · Security Note
• https://github.com/ashleysommer/sanic-cors/blob/master/sanic_cors/core.py · Note
• https://github.com/ashleysommer/sanic-cors · Note
• https://twitter.com/VulmonFeeds/status/2062955646719324518 · Twitter Post
• https://pypi.org/project/Sanic-Cors · Note