GitHub Advisoryadvisory · npm
GHSA-37q6-576q-vgr7 Missing Origin Validation in parcel-bundler
HIGH
Official page ↗
- Aliases
- CVE-2018-14731
- Ecosystem
- npm
- Packages
- parcel-bundler
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2020-06-16
Affected packages
• npm parcel-bundler: < 1.10.0 → fixed in 1.10.0
Description
Versions of `parcel-bundler` before 1.10.0 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.
Recommendation
Update to version 1.10.0 or later.
Related
Alias · CVE (1)
- CVE-2018-14731 An issue was discovered in HMRServer.js in Parcel parcel-bundler. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-14731 advisory
- https://github.com/parcel-bundler/parcel/issues/1783 web
- https://github.com/parcel-bundler/parcel/pull/1794 web
- https://github.com/parcel-bundler/parcel/commit/066e0bf6bd26b15c78bd47df023452e4b20073e4 web
- https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages web
- https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages) web
- https://github.com/advisories/GHSA-37q6-576q-vgr7 advisory
- https://github.com/parcel-bundler/parcel package
- https://www.npmjs.com/advisories/721 web