CVE-2025-50864: Insecure Cors Origin Substring
Insecure origin validation using a substring match. When validating CORS origins without a protocol schema, using a substring match logic (`.includes` or `indexOf`) allows attackers to bypass restrictions by using a malicious domain that unexpectedly contains the allowed origin as a substring (e.g., `notexample.com` bypasses `example.com`). Use exact string
JSgreprules fetch cve-2025-50864-insecure-cors-origin-substring --engine opengrepDescription
Insecure origin validation using a substring match. When validating CORS origins without a protocol schema, using a substring match logic (`.includes` or `indexOf`) allows attackers to bypass restrictions by using a malicious domain that unexpectedly contains the allowed origin as a substring (e.g., `notexample.com` bypasses `example.com`). Use exact string
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.