CVE-2025-56647

6.5 mediumEPSS 0.2%

Medium (6.5). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in @farmfe/core 1.7.6.

npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leaked by the WebSocket server.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-1385
Published: 2026-02-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-p773-8mf4-rjm5	npm	@farmfe/core	<1.7.6	1.7.6

References

https://gist.github.com/R4356th/d4372c6f83275d583c180c0e7d7332af
https://github.com/farm-fe/farm/commit/83342ef06e0aea37270950fd8c930422c4df0679
https://github.com/farm-fe/farm/issues/2168

Check your stack JSON