GHSA-8hmm-4crw-vm2c
@musistudio/claude-code-router has improper CORS configuration
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @musistudio/claude-code-router | < 1.0.34 | 1.0.34 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Due to improper Cross-Origin Resource Sharing (CORS) configuration, there is a risk that user API Keys or equivalent credentials may be exposed to untrusted domains. Attackers could exploit this misconfiguration to steal credentials, abuse accounts, exhaust quotas, or access sensitive data.
### Patches
The issue has been patched in v1.0.34.
References
External links from the advisory. They lead to third-party sites.