GitHub Advisoryadvisory · npm

GHSA-p773-8mf4-rjm5 @farmfe/core is Missing Origin Validation in WebSocket

MEDIUM Published 2026-02-12 Modified 2026-02-12 Official page ↗
Aliases
CVE-2025-56647
Ecosystem
npm
Packages
@farmfe/core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-1385
Reviewed
2026-02-12

Affected packages

• npm @farmfe/core: < 1.7.6 → fixed in 1.7.6

Description

npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leaked by the WebSocket server.

Related

Alias · CVE (1)

  • CVE-2025-56647 npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. vulnerability

Weakness · CWE (1)

  • CWE-1385 Missing Origin Validation in WebSockets weakness

References