CVE-2026-25478 — Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins

Affected: litestar-org litestar

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built from configured allowlist values and used with fullmatch() for validation. Because metacharacters are not escaped, a malicious origin can match unexpectedly. The check relies on allowed_origins_regex.fullmatch(origin). This vulnerability is fixed in 2.20.0.

GHSA-2p2x-hpg8-cqp2 — Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins

Affected: PyPI: litestar

### Summary CORS origin validation can be bypassed because the allowed-origins allowlist is compiled into a regex without escaping metacharacters (notably .). An allowed origin like https://good.example can match https://goodXexample, resulting in Access-Control-Allow-Origin being set for an untrusted origin

### Details CORSConfig.allowed_origins_regex is constructed using a regex built from configured allowlist values and used with fullmatch() for validation. Because metacharacters are not escaped, a malicious origin can match unexpectedly. The check relies on allowed_origins_regex.fullmatch(origin).

### PoC Server (poc_cors_server.py)

``` from litestar import Litestar, get from litestar.config.cors import CORSConfig

@get("/c") async def c() -> str: return "ok"

cors = CORSConfig( allow_origins=["https://good.example"], allow_credentials=True, ) app = Litestar([c], cors_config=cors) ```

`uvicorn poc_cors_server:app --host 127.0.0.1 --port 8002`

Client (poc_cors_client.py)

``` import http.client

def req(origin: str) -> tuple[int, str | None]: c = http.client.HTTPConnection("127.0.0.1", 8002, timeout=3) c.request("GET", "/c", headers={"Origin": origin, "Host": "example.com"}) r = c.getresponse() r.read() acao = r.getheader("Access-Control-Allow-Origin") c.close() return r.status, acao

print("evil:", req("https://evil.example")) print("bypass:", req("https://goodXexample")) ```

Expected (vulnerable behavior):

Origin: https://…

Most recent entries from all

CVE-2026-25478 — Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins

GHSA-2p2x-hpg8-cqp2 — Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins