CVE-2026-37737: sanic-cors contains an improper regular expression in the try_match() function

June 5, 2026 (updated July 17, 2026)

sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain unauthorized access to cross-origin requests for authenticated resources.

References

github.com/advisories/GHSA-94jw-hqvj-vw74
github.com/ashleysommer/sanic-cors/blob/master/sanic_cors/core.py
github.com/npbhatter17/security-advisories/blob/main/CVE-2026-37737-sanic-cors-advisory.md
nvd.nist.gov/vuln/detail/CVE-2026-37737
pypi.org/project/Sanic-Cors

Code Behaviors & Features

Detect and mitigate CVE-2026-37737 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →