What is GHSA-8hmm-4crw-vm2c?

GHSA-8hmm-4crw-vm2c is a security advisory published by GitHub Security Advisories with High severity. @musistudio/claude-code-router has improper CORS configuration

Which CVE IDs does GHSA-8hmm-4crw-vm2c cover?

GHSA-8hmm-4crw-vm2c covers the following CVE IDs: CVE-2025-57755. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-8hmm-4crw-vm2c?

GHSA-8hmm-4crw-vm2c affects 1 product, including: npm/@musistudio/claude-code-router:\u003c 1.0.34.

GHSA-8hmm-4crw-vm2cHigh

@musistudio/claude-code-router has improper CORS configuration

Vendor

GitHub Security Advisories

Published

August 21, 2025

Last Modified

August 21, 2025

🔗 CVE IDs covered (1)

CVE-2025-57755 →

📋 Description

Impact

Due to improper Cross-Origin Resource Sharing (CORS) configuration, there is a risk that user API Keys or equivalent credentials may be exposed to untrusted domains. Attackers could exploit this misconfiguration to steal credentials, abuse accounts, exhaust quotas, or access sensitive data.

Patches

The issue has been patched in v1.0.34.

🎯 Affected products1

npm/@musistudio/claude-code-router:< 1.0.34

🔗 References (4)

https://github.com/musistudio/claude-code-router/security/advisories/GHSA-8hmm-4crw-vm2c
https://github.com/musistudio/claude-code-router/issues/549
https://nvd.nist.gov/vuln/detail/CVE-2025-57755
https://github.com/advisories/GHSA-8hmm-4crw-vm2c