GitHub Advisoryadvisory · npm

GHSA-77q4-m83q-w76v Missing Origin Validation in browserify-hmr

HIGH Published 2020-09-01 Modified 2021-09-24 Official page ↗
Aliases
CVE-2018-14730
Ecosystem
npm
Packages
browserify-hmr
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2020-08-31

Affected packages

• npm browserify-hmr: < 0.4.0 → fixed in 0.4.0

Description

Versions of `browserify-hmr` prior to 0.4.0 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated. Recommendation Upgrade to version 0.4.0 or later.

Related

Alias · CVE (1)

  • CVE-2018-14730 An issue was discovered in Browserify-HMR. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References