#1
Unauthenticated localhost API with wildcard CORS allows cross-origin command injection
lixenstrand