CVE-2026-37737 Details
Description
sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain unauthorized access to cross-origin requests for authenticated resources.
A CORS origin allowlist bypass vulnerability exists in Sanic-Cors versions through 2.2.0. The issue arises from an improper regular expression in the try_match() function of sanic_cors/core.py, where re.match() is used without end-anchoring. This flaw allows attackers to bypass CORS restrictions by registering domains that start with a trusted origin, thereby gaining unauthorized access to cross-origin requests for authenticated resources.
Users can upgrade to Sanic-Cors version 2.2.1 or later, where this vulnerability has been fixed. For those who cannot upgrade, it is recommended to use exact-string origin allowlists instead of regular expressions, and to ensure that any regex origins are properly anchored at both ends.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 5, 2026CISA-ADP
Assessed Jun 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ashleysommer/sanic-cors | [email protected] | ProductSource CodeVendor |
| https://github.com/ashleysommer/sanic-cors/blob/master/sanic_cors/core.py | [email protected] | Source CodeVendor |
| https://github.com/npbhatter17/security-advisories/blob/main/CVE-2026-37737-sanic-cors-advisory.md | [email protected] | AdvisoryExploitRemedy |
| https://pypi.org/project/Sanic-Cors/ | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | CISA-ADP |
| CWE-625 | Permissive Regular Expression | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| sanic-cors | <= 2.2.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | New CVE Received | [email protected] |