Executive brief
Litestar is a Python web framework that uses CORS (Cross-Origin Resource Sharing) configuration to control which external websites can access sensitive data from authenticated user sessions. The CORS origin allowlist validation fails to properly escape regex metacharacters, allowing an attacker to craft a malicious origin domain that matches the allowlist policy unexpectedly. If a site is configured to trust "https://good.example", an attacker can craft "https://goodXexample" (where X matches any character due to unescaped dot metacharacter) and bypass the policy, potentially reading sensitive data from victim browsers in authenticated sessions.
Technical details
The vulnerability exists in Litestar's CORSConfig.allowed_origins_regex implementation, which constructs a regex pattern from user-configured allowlist values without escaping metacharacters (particularly the dot character). When the origin validation check uses regex fullmatch() against untrusted Origin headers, metacharacters in the allowlist are interpreted as regex patterns rather than literal characters. For example, "https://good.example" with an unescaped dot allows matching "https://goodXexample" where X is any character. An attacker can register or control a domain matching this regex pattern, bypass the CORS policy, and read cross-origin responses in a victim's authenticated browser session if allow_credentials=True. The vulnerability was introduced in version 2.19.0 and fixed in version 2.20.0 by properly escaping metacharacters in the regex construction.
Affected products
- Litestar Litestar 2.19.0 before 2.20.0
Timeline
- 2026-02-09: disclosed: GHSA-2p2x-hpg8-cqp2 published
- 2026-02-09: patched: Fix released in version 2.20.0