{"data":{"id":"cb4424df-1812-4aaa-83a6-ad4bd5b91707","title":"CVE-2025-57755: claude-code-router is a powerful tool to route Claude Code requests to different models and customize any request. Due…","summary":"CVE-2025-57755 affects claude-code-router, a tool that routes Claude Code requests to different models. Improper Cross-Origin Resource Sharing (CORS) configuration can expose user API Keys or equivalent credentials to untrusted domains. Attackers could use this to steal credentials, abuse accounts, exhaust quotas, or access sensitive data.","solution":"Patched in v1.0.34.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-57755","publishedAt":"2025-08-21T17:15:31.610Z","cveId":"CVE-2025-57755","cweIds":["CWE-200","CWE-942"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@musistudio/claude-code-router@< 1.0.34 (fixed: 1.0.34)"],"affectedPackageNames":["@musistudio/claude-code-router"],"affectedPackageRefs":["npm:@musistudio/claude-code-router"],"affectedVendors":[],"affectedVendorsRaw":["claude-code-router","Claude Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"claude-code-router CORS misconfiguration exposes API keys to untrusted domains","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00305,"epssCheckedAt":"2026-11-04T18:09:13.251Z","kevDateAdded":null,"advisoryAliases":["GHSA-8hmm-4crw-vm2c"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:54.586Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-08-10T13:37:46.753Z","daysToFix":-11,"fixCheckedAt":"2026-10-29T21:43:55.035Z","capecIds":["CAPEC-116"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@musistudio/claude-code-router","fixedVersion":"1.0.34","matchedVersion":"1.0.34","fixReleasedAt":"2025-08-10T13:37:46.753Z","daysToFix":-11,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:43:54.885Z"}]}}