Description
Versions of parcel-bundler before 1.10.0 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer’s source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.
Recommendation
Update the parcel-bundler package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.10.0
- Patched version(s): 1.10.0
References
- GHSA-37q6-576q-vgr7
- www.npmjs.com
- blog.cal1.cn){:target=”_blank”}{:rel=”noopener noreferrer”}
- CVE-2018-14731
- CWE-200
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A6
Related Issues
- Missing Origin Validation in browserify-hmr - CVE-2018-14730
- @farmfe/core is Missing Origin Validation in WebSocket - CVE-2025-56647
- tiny-json-http missing SSL certificate validation - CVE-2018-1000096
- locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor - CVE-2026-41886
You might also like:
- Tags:
- npm
- parcel-bundler
Anything's wrong? Let us know Last updated on January 09, 2023