# CodeBuddy Code v2.70.1 Release

## Security Fixes

### CORS Cross-Origin Attack Protection

Fixed a cross-origin request security vulnerability in the local Gateway service (`cbc --serve`). Previously, malicious web pages could use JavaScript to make cross-origin requests to the user's local localhost service, executing Agent commands or stealing output data.

Key fixes:

- Replaced the framework's default `Access-Control-Allow-Origin: *` with a precise allowlist mechanism, only permitting cross-origin requests from localhost, 127.0.0.1, and Tunnel URLs
- Added Host header validation middleware to prevent DNS Rebinding attacks
- Fixed CORS wildcard vulnerability on SSE streaming endpoints
- Changed the default bind address from `0.0.0.0` to `127.0.0.1` to prevent the service from being exposed to the local network

## Improvements

- **Custom CORS Rules**: Support configuring allowed cross-origin sources via the `CODEBUDDY_CODE_CORS_ORIGINS` environment variable (comma-separated) or the `gateway.corsOrigins` Settings option, accommodating special use cases
