CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NCVE-2025-56648
Medium (6.5) in parceljs parcel. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in @parcel/reporter-dev-server 2.16.4.
npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
- CWE
- CWE-346
- Published
- Modified
- Record from
- the NVD, synced
Affected
- parceljs:parcel
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qm9p-f9j5-w83w | npm | @parcel/reporter-dev-server | >=1.6.1 <2.16.4 | 2.16.4 |