GitHub Advisoryadvisory · npm
GHSA-qm9p-f9j5-w83w Parcel has an Origin Validation Error vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2025-56648
- Ecosystem
- npm
- Packages
- @parcel/reporter-dev-server
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-346
- Reviewed
- 2025-09-18
Affected packages
• npm @parcel/reporter-dev-server: >= 1.6.1, < 2.16.4 → fixed in 2.16.4
Description
parcel versions 1.6.1 and above have an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them. Version 2.16.4 supports a `--no-cors` option which disables CORS headers in the dev server.
Related
Alias · CVE (1)
- CVE-2025-56648 npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. vulnerability
Weakness · CWE (1)
- CWE-346 Origin Validation Error weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-56648 advisory
- https://github.com/parcel-bundler/parcel/issues/10216 web
- https://github.com/parcel-bundler/parcel/pull/10138 web
- https://github.com/parcel-bundler/parcel/commit/4bc56e3242a85491c7edf589966e9b44c6330c49 web
- https://github.com/parcel-bundler/parcel/commit/9e2f6f1377123cff3b82f6dde4e20336efc846a1 web
- https://gist.github.com/R4356th/41f468def606b2406e36f7193f5322b8 web
- https://github.com/parcel-bundler/parcel package
- https://github.com/parcel-bundler/parcel/discussions/10089 web