1 files changed, 5 insertions, 0 deletions
diff --git a/modules/core/module-manager.js b/modules/core/module-manager.js
index 8cecc4d..4723bff 100644
--- a/modules/core/module-manager.js
+++ b/modules/core/module-manager.js
@@ -36,6 +36,11 @@
             }
             async loadModuleFromURL(url) {
                 try {
+                    // Security: block cross-origin URLs for module loading
+                    if (url && url.match(/^https?:\/\//) && !url.startsWith(window.location.origin)) {
+                        this.terminal.print(`⚠️ Security: only same-origin URLs allowed for module loading`, 'error');
+                        return false;
+                    }
                     this.terminal.print(`Loading module from ${url}...`, 'info');
                     const response = await fetch(url);
                     if (!response.ok) throw new Error(`HTTP ${response.status}`);