GHSA-qm9p-f9j5-w83w

Parcel has an Origin Validation Error vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-56648

Packages

Ecosystem	Package	Affected	Fixed in
npm	@parcel/reporter-dev-server	>= 1.6.1, < 2.16.4	2.16.4

Details

As written in the advisory (Markdown source, shown as plain text).

parcel versions 1.6.1 and above have an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them. Version 2.16.4 supports a `--no-cors` option which disables CORS headers in the dev server.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-56648 advisory
https://github.com/parcel-bundler/parcel/issues/10216 web
https://github.com/parcel-bundler/parcel/pull/10138 web
https://github.com/parcel-bundler/parcel/commit/4bc56e3242a85491c7edf589966e9b44c6330c49 web
https://github.com/parcel-bundler/parcel/commit/9e2f6f1377123cff3b82f6dde4e20336efc846a1 web
https://gist.github.com/R4356th/41f468def606b2406e36f7193f5322b8 web
https://github.com/parcel-bundler/parcel package
https://github.com/parcel-bundler/parcel/discussions/10089 web