Skip to content
OpenAdvisories

Vendor

litestar-org

9 known vulnerabilities.

Products

litestar 9
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.1
    CVE-2026-48060 Public exploit

    Litestar: HTML Injection Through CSRF Token

    Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting …

    litestar-org litestar litestar PyPI
  • High 7.4
    CVE-2026-25478

    Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins

    Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built from configured allowlist values and used with fullmatch() for validation. Because metacharacters are n…

    litestar-org litestar litestar PyPI
  • High 7.5
    CVE-2025-59152

    X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting

    Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar…

    litestar-org litestar litestar PyPI
  • High 8.2
    CVE-2024-52581

    Litestar allows unbounded resource consumption (DoS vulnerability)

    Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the req…

    litestar-org litestar litestar starlite PyPI
  • High 8.3
    CVE-2024-42370 Public exploit

    Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow

    Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This…

    litestar-org litestar
  • High 8.2
    CVE-2024-32982

    Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion (LFI) vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows at…

    litestar-org litestar litestar starlite PyPI