HTTP Header Injection

sanic is vulnerable to HTTP header inject attacks. The vulnerability exists due to the lack of sanitization of the URL field, allowing arbitrary header injection...

Directory traversal

Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring...