CVE-2026-40110 Jupyter Server CORS验证绕过漏洞

import re # Simulated configuration value from allow_origin_pat trusted_pattern = r"trusted\.example\.com" # Malicious origin controlled by attacker # e.g., attacker registers 'trusted.example.com.evil.com' malicious_origin = "trusted.example.com.evil.com" # Vulnerable check using re.match() (Start anchor only) if re.match(trusted_pattern, malicious_origin): print(f"[+] Vulnerability Detected! Origin '{malicious_origin}' bypassed validation.") # Attacker can now send CORS requests to the server else: print("[-] Validation failed.") # Correct check should use fullmatch or end anchor ($) # if re.match(trusted_pattern + r"$", malicious_origin):