54 matches found
PYSEC-2026-3539 sanic-cors contains an improper regular expression in the try_match() function
sanic-cors version 2.2.0 and prior contains an improper regular expression in the trymatch function in saniccors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain...
PYSEC-2026-918 sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs
Impact Access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted. Patches - v20.12.7 LTS - v21.12.2 LTS - v22.6.1 References https://github.com/sanic-org/sanic/issues/2478 https://github.com/sanic-org/sanic/pull/2495 For more...
CVE-2026-37737
sanic-cors version 2.2.0 and prior contains an improper regular expression in the trymatch function in saniccors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain...
Access Control Bypass
Overview Sanic-Cors is an A Sanic extension adding a decorator for CORS support. Based on flask-cors by Cory Dolphin. Affected versions of this package are vulnerable to Access Control Bypass via the trymatch function. An attacker can gain unauthorized access to cross-origin requests for...
GHSA-94JW-HQVJ-VW74 sanic-cors contains an improper regular expression in the try_match() function
sanic-cors version 2.2.0 and prior contains an improper regular expression in the trymatch function in saniccors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain...
CVE-2026-37737
sanic-cors version 2.2.0 and prior contains an improper regular expression in the trymatch function in saniccors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain...
PT-2026-46962
Name of the Vulnerable Software and Affected Versions sanic-cors versions prior to 2.2.1 Description An improper regular expression is used in the try match function within sanic cors/core.py. The function utilizes re.match without end-anchoring, which allows an attacker to bypass Cross-Origin...
EUVD-2026-34844
sanic-cors version 2.2.0 and prior contains an improper regular expression in the trymatch function in saniccors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain...
CVE-2026-37737
Sanic-Cors 2.2.0 and earlier versions contain an improper regular expression in the try_match() function of sanic_cors/core.py that uses re.match without end anchoring. This allows bypassing CORS origin allowlists by registering a domain that starts with a trusted origin string, leading to unauth...
CVE-2026-37737
sanic-cors version 2.2.0 and prior contains an improper regular expression in the trymatch function in saniccors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain...
CVE-2026-37737
sanic-cors version 2.2.0 and prior contains an improper regular expression in the trymatch function in saniccors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain...
EUVD-2017-0127
Malware in sbrugna...
EUVD-2022-6514
Malicious code in bioql PyPI...
CVE-2022-35920
Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue...
aclients (>=1.0.0b31 <=1.0.1b1), aiocqhttp-sanic (>=1.2.3 <=1.2.3rc1) +71 more potentially affected by CVE-2022-35920 via sanic (>=0.3.1 <=20.12.2)
sanic PYPI version =0.3.1, =1.0.0b31, =1.2.3, =0.1.0a6, =0.6.1, =0.39.0, =0.0.4, =0.8.0, =0.0.2, =0.0.2.8.5 and more Source cves: CVE-2022-35920 Source advisory: OSV:GHSA-8CW9-5HMV-77W6...
GHSA-8CW9-5HMV-77W6 sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs
Impact Access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted. Patches - v20.12.7 LTS - v21.12.2 LTS - v22.6.1 References https://github.com/sanic-org/sanic/issues/2478 https://github.com/sanic-org/sanic/pull/2495 For more...
ai-services (>=0.1.0 <=0.5.0rc12), circe-certic (>=0.0.37 <=0.0.40) +21 more potentially affected by CVE-2022-35920 via sanic (>=22.12.0 <=22.6.0)
sanic PYPI version =22.12.0, =0.1.0, =0.0.37, =0.1.4, =0.0.1, =0.1.127, =0.1.0b2, =0.1.0, =0.4.2, =0.1.7, =3.14.0, =3.8.0b1.dev2, =0.1.0, =2.0.0, =2.2.8 and more Source cves: CVE-2022-35920 Source advisory: OSV:GHSA-8CW9-5HMV-77W6...
apthesaurus (=22.2.1), ax (=0.3.0) +2 more potentially affected by CVE-2022-35920 via sanic (>=21.12.0 <=21.12.1)
sanic PYPI version =21.12.0, =22.1.1, =21.1.5.4, =22.2.3 Source cves: CVE-2022-35920 Source advisory: OSV:GHSA-8CW9-5HMV-77W6...
sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs
Impact Access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted. Patches - v20.12.7 LTS - v21.12.2 LTS - v22.6.1 References https://github.com/sanic-org/sanic/issues/2478 https://github.com/sanic-org/sanic/pull/2495 For more...
Directory Traversal
sanic is vulnerable to directory traversal. The vulnerability exists due to a lack of sanitization of URL paths in the handler function allowing an attacker to access lateral directories when using app.static if using encoded %2F URLs...