PT-2026-7135 · Litestar · Litestar

Sirdorblu · Published 2026-02-09 · Updated 2026-02-10 · CVE-2026-25478

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Litestar versions prior to 2.20.0

Description Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, the CORS origin validation process can be bypassed. This occurs because the allowed-origins allowlist is compiled into a regular expression without properly escaping metacharacters. Specifically, the allowed origins regex is constructed using configured allowlist values and used with fullmatch() for validation. A malicious origin can unexpectedly match due to the lack of escaping, potentially leading to cross-origin data exposure if allow credentials is set to True and authenticated endpoints return sensitive data. The vulnerable component is CORSConfig.allowed origins regex and the validation relies on allowed origins regex.fullmatch(origin). The issue is related to the use of regular expressions for validating the Origin header.

Recommendations Versions prior to 2.20.0 should be updated to version 2.20.0 or later to address this issue.

Exploit

Fix

Weakness Enumeration

CWE-942

Related Identifiers

CVE-2026-25478

GHSA-2P2X-HPG8-CQP2

Affected Products

Litestar

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25478.json · Exploit
• https://github.com/litestar-org/litestar/commit/eb87703b309efcc0d1b087dcb12784e76b003d5a · Patch
• https://github.com/litestar-org/litestar/security/advisories/GHSA-2p2x-hpg8-cqp2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25478 · Security Note
• https://osv.dev/vulnerability/GHSA-2p2x-hpg8-cqp2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25478 · Vendor Advisory
• https://github.com/litestar-org/litestar/releases/tag/v2.20.0 · Note
• https://github.com/litestar-org/litestar · Note
• https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0 · Note
• https://twitter.com/CVEnew/status/2020959702079647980 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r1174e/resumen_diario_de_vulnerabilidades_10022026 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2020996704556782073 · Twitter Post