HIGH7.4PyPI
GHSA-2p2x-hpg8-cqp2· CVE-2026-25478, PYSEC-2026-2195Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins
Modified: 7/13/2026
package
PyPI/litestar
pkg:pypi/litestar
MEDIUM5.9PyPI
GHSA-3qmc-cj7q-62hv· CVE-2026-48061, PYSEC-2026-2603Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
Modified: 7/13/2026
HIGH8.1PyPI
GHSA-542p-wvx7-72m4· CVE-2026-48060, PYSEC-2026-2604Litestar has HTML Injection Through its CSRF Token
Modified: 7/13/2026
LOW3.7PyPI
GHSA-674p-xv2x-rf3gLitestar has potential log injection in exception logging
Modified: 8/12/2025
HIGH8.2PyPI
GHSA-83pv-qr33-2vcf· CVE-2024-32982, PYSEC-2026-1552Litestar and Starlite vulnerable to Path Traversal
Modified: 9/10/2026
MEDIUM6.5PyPI
GHSA-93ph-p7v4-hwh4· CVE-2026-25479, PYSEC-2026-2196Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns
Modified: 7/13/2026
HIGH7.5PyPI
GHSA-gjcc-jvgw-wvwj· CVE-2024-52581, PYSEC-2024-178Litestar allows unbounded resource consumption (DoS vulnerability)
Modified: 7/7/2026
HIGH7.5PyPI
GHSA-hm36-ffrh-c77c· CVE-2025-59152, PYSEC-2026-1553Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion
Modified: 7/7/2026
MEDIUM6.5PyPI
GHSA-vxqx-rh46-q2pg· CVE-2026-25480, PYSEC-2026-2197Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2024-178· CVE-2024-52581, GHSA-gjcc-jvgw-wvwjModified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1553· CVE-2025-59152, GHSA-hm36-ffrh-c77cLitestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion
Modified: 7/7/2026
MEDIUM6.5PyPI
PYSEC-2026-2195· CVE-2026-25478, GHSA-2p2x-hpg8-cqp2Modified: 7/13/2026
MEDIUM6.5PyPI
PYSEC-2026-2196· CVE-2026-25479, GHSA-93ph-p7v4-hwh4Modified: 7/13/2026
MEDIUM6.5PyPI
PYSEC-2026-2197· CVE-2026-25480, GHSA-vxqx-rh46-q2pgModified: 7/13/2026
MEDIUM5.9PyPI
PYSEC-2026-2603· CVE-2026-48061, GHSA-3qmc-cj7q-62hvLitestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
Modified: 7/13/2026
HIGH8.1PyPI
PYSEC-2026-2604· CVE-2026-48060, GHSA-542p-wvx7-72m4Litestar has HTML Injection Through its CSRF Token
Modified: 7/13/2026
HIGH8.2PyPI
PYSEC-2026-2605· CVE-2024-32982, GHSA-83pv-qr33-2vcfLitestar and Starlite vulnerable to Path Traversal
Modified: 7/13/2026