CVE-2026-37737: sanic-cors contains an improper regular expression in the try_match() function

June 5, 2026 (updated July 17, 2026)

sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain unauthorized access to cross-origin requests for authenticated resources.

References

github.com/advisories/GHSA-94jw-hqvj-vw74
github.com/ashleysommer/sanic-cors/blob/master/sanic_cors/core.py
github.com/npbhatter17/security-advisories/blob/main/CVE-2026-37737-sanic-cors-advisory.md
nvd.nist.gov/vuln/detail/CVE-2026-37737
pypi.org/project/Sanic-Cors

Code Behaviors & Features

Detect and mitigate CVE-2026-37737 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →