CVE-2025-57755: 
JavaScript vulnerability analysis and mitigation

CVE-2025-57755 is an improper Cross-Origin Resource Sharing (CORS) configuration vulnerability in claude-code-router (npm package @musistudio/claude-code-router), a tool used to route Claude Code requests to different AI models. The flaw allows untrusted domains to access user API keys or equivalent credentials through overly permissive CORS headers. All versions prior to 1.0.34 are affected. The vulnerability was published on August 21, 2025, with a CVSS v4 base score of 8.1 (High) (GitHub Advisory, GHSA).

The root cause is a permissive CORS policy that fails to restrict cross-origin requests to trusted domains, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-942 (Permissive Cross-domain Security Policy with Untrusted Domains). Because the application does not enforce strict origin validation, a malicious web page hosted on an untrusted domain can issue cross-origin requests to the locally or remotely running claude-code-router service and receive responses containing API keys or credentials. Exploitation requires no authentication, no special privileges, and no user interaction beyond a victim visiting an attacker-controlled page (GitHub Advisory).

Successful exploitation could allow an attacker to steal user API keys for Claude or other configured AI model providers, enabling unauthorized use of those accounts, quota exhaustion, and access to sensitive data processed through the router. Because API keys grant full programmatic access to the associated accounts, the impact extends to financial abuse (billing exhaustion), data exfiltration of prompts and responses, and potential pivoting to other services that share the same credentials (GitHub Advisory, GHSA).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.041–0.101%, placing it in the 27th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify users or systems running claude-code-router versions prior to 1.0.34, which expose a local or network-accessible HTTP service.
2. Set up malicious page: Host a web page on an attacker-controlled domain that contains JavaScript to issue cross-origin HTTP requests (e.g., fetch() or XMLHttpRequest) to the target claude-code-router service endpoint.
3. Trigger cross-origin request: Lure the victim (who has claude-code-router running) to visit the malicious page. The browser sends a cross-origin request to the router service.
4. Receive credentials: Due to the permissive CORS configuration, the router responds with Access-Control-Allow-Origin: * (or equivalent), allowing the attacker's page to read the response body, which may contain API keys or session credentials.
5. Abuse stolen credentials: Use the harvested API keys to make unauthorized requests to Claude or other configured AI model APIs, exhaust quotas, or access sensitive data (GitHub Advisory).

• Network: Unexpected cross-origin HTTP requests to the claude-code-router service port from browser-originated traffic with Origin headers pointing to unknown or external domains; unusual outbound API calls to Claude or other AI provider endpoints from the host running the router.
• Logs: Access logs for the claude-code-router service showing requests with Origin headers from untrusted or external domains; API provider logs showing unusual usage spikes, requests from unexpected IP addresses, or quota exhaustion events.
• Application: Unexpected API key usage in Claude or other AI provider dashboards not matching normal usage patterns; billing anomalies or quota depletion without corresponding local activity.

The issue is patched in claude-code-router v1.0.34; users should upgrade immediately via npm update @musistudio/claude-code-router or equivalent (GitHub Advisory). As interim workarounds, restrict the CORS configuration to explicitly whitelist only trusted origins, and avoid exposing the claude-code-router service on network interfaces accessible to untrusted clients. Additionally, rotate any API keys that may have been exposed while running a vulnerable version, and monitor AI provider dashboards for unauthorized usage.

The vulnerability was reported by security researcher ttttmr and disclosed by the maintainer (musistudio) via GitHub Security Advisories on August 21, 2025 (GHSA). Coverage has been limited to automated vulnerability tracking feeds and aggregators; no significant independent researcher commentary or broad media coverage has been identified.