FastAPI-Guard, Regular Expression Bypass, CVE-2023-XXXX (Critical)

Listen to this Post

🐢▶️ Listen🚀

How the CVE Works

The vulnerability arises from insufficient input validation in FastAPI-Guard’s regex-based filtering. The patch intended to mitigate ReDoS (Regular Expression Denial of Service) by limiting input length (e.g., <script[^>]{0,100}>) fails when attribute strings exceed 100 characters. Attackers can craft malicious payloads (e.g., <script id="a...a{100}">) to bypass filters, enabling XSS or SQL injection. The PoC demonstrates this by comparing responses to a normal payload versus an oversized one, confirming the regex fails to block excessively long inputs.

DailyCVE Form

Platform: FastAPI-Guard
Version: 3.0.1
Vulnerability: Regex bypass
Severity: Critical
Date: 2023-XX-XX

Prediction: Patch by Q4 2023

What Undercode Say

git clone https://github.com/rennf93/fastapi-guard
cd fastapi-guard/examples
docker-compose up

import requests
requests.post("http://localhost:8000", json={"suspicious": "<script a='...100+ chars'>"})

How Exploit

Craft oversized `