Litestar versions older than 2.20.0 build a regular expression from the configured allowlist values without escaping metacharacters, and this expression is used with fullmatch() to validate the Origin header. Because special characters are not escaped, a malicious Origin value can match the resulting regex and be treated as an allowed origin. This flaw permits an attacker to trick the application into accepting requests from an arbitrary origin, effectively bypassing the intended CORS policy and potentially exposing the application to cross-origin data leakage. This is a CWE-942 vulnerability, indicating improper neutralization of special elements in a regex.

The Litestar ASGI framework, developed by litestar-org, is affected. All releases prior to 2.20.0 contain the unescaped regex logic and are vulnerable. The issue is fixed in version 2.20.0 and subsequent releases.

The CVSS score of 7.4 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is client-side: an attacker must craft a request with a malformed Origin header that satisfies the flawed regex. If successful, the attacker can make the server accept cross-origin requests from an origin that is not on the intended allowlist, thereby bypassing the CORS policy. Given the high severity and the low current exploitation likelihood, organizations should treat this as a high‑risk issue until a patch is applied.