CVE-2026-5321 vanna-ai CORS配置不当漏洞

import requests # Target URL (Replace with actual vulnerable instance) target_url = "http://localhost:8000/api/generate" # Simulate a malicious origin malicious_origin = "http://evil.com" headers = { "Origin": malicious_origin, "User-Agent": "CVE-2026-5321-Scanner" } try: # Send a preflight or simple request response = requests.get(target_url, headers=headers) # Check for CORS headers in response acao_header = response.headers.get("Access-Control-Allow-Origin") print(f"[+] Request sent to: {target_url}") print(f"[+] Sent Origin: {malicious_origin}") print(f"[+] Received Access-Control-Allow-Origin: {acao_header}") # If the server reflects the malicious origin or allows wildcard, it is vulnerable if acao_header == malicious_origin or acao_header == "*": print("[!] Vulnerability Confirmed: Permissive CORS policy detected.") else: print("[-] Vulnerability not detected.") except Exception as e: print(f"[!] Error occurred: {e}")