Executive brief
Sanic-Cors is a Python library used to manage Cross-Origin Resource Sharing (CORS) for the Sanic web framework, which controls which websites are allowed to access an application's data. A flaw in how the library validates these websites allows an attacker to bypass security restrictions by using a specially crafted domain name (e.g., "trusted.com.attacker.io"). If a user visits the attacker's site, the attacker can steal sensitive information from the vulnerable application, such as private user data or authentication details.
Technical details
The vulnerability exists in the try_match() function within sanic_cors/core.py due to the use of re.match() without end-anchoring. In Python, re.match() only anchors the pattern to the beginning of the string; consequently, an allowlist entry like 'https://trusted.com' will incorrectly match 'https://trusted.com.attacker.io'. An attacker can exploit this by registering a domain that starts with a trusted origin string and inducing a victim to visit a malicious page. This results in the attacker's origin being reflected in the Access-Control-Allow-Origin header, allowing the attacker to read cross-origin responses from authenticated resources. The issue can be remediated by using re.fullmatch() or appending an explicit end anchor (\Z) to the regular expression.
Affected products
- ashleysommer sanic-cors <= 2.2.0
Timeline
- 2026-06-05: disclosed
- 2026-06-05: advisory