github_osv/GHSA-8hmm-4crw-vm2c
@musistudio/claude-code-router has improper CORS configuration
### Impact
Due to improper Cross-Origin Resource Sharing (CORS) configuration, there is a risk that user API Keys or equivalent credentials may be exposed to untrusted domains. Attackers could exploit this misconfiguration to steal credentials, abuse accounts, exhaust quotas, or access sensitive data.
### Patches
The issue has been patched in v1.0.34.
gitlab/npm/@musistudio/claude-code-router/CVE-2025-57755
@musistudio/claude-code-router has improper CORS configuration
Due to improper Cross-Origin Resource Sharing (CORS) configuration, there is a risk that user API Keys or equivalent credentials may be exposed to untrusted domains. Attackers could exploit this misconfiguration to steal credentials, abuse accounts, exhaust quotas, or access sensitive data.