Missing Origin Validation in parcel-bundler - parcel-bundler

Description

Versions of parcel-bundler before 1.10.0 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer’s source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.

Recommendation

Update the parcel-bundler package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.10.0
• Patched version(s): 1.10.0

References

• GHSA-37q6-576q-vgr7
• www.npmjs.com
• blog.cal1.cn){:target=”_blank”}{:rel=”noopener noreferrer”}
• CVE-2018-14731
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6