npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them.
References
| Link | Resource |
|---|---|
| https://gist.github.com/R4356th/41f468def606b2406e36f7193f5322b8 | Exploit |
| https://github.com/parcel-bundler/parcel/discussions/10089 | Issue Tracking |
| https://github.com/parcel-bundler/parcel/issues/10216 | Exploit Issue Tracking |
Configurations
Configuration 1 (hide)
|
History
26 Sep 2025, 15:06
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gist.github.com/R4356th/41f468def606b2406e36f7193f5322b8 - Exploit | |
| References | () https://github.com/parcel-bundler/parcel/discussions/10089 - Issue Tracking | |
| References | () https://github.com/parcel-bundler/parcel/issues/10216 - Exploit, Issue Tracking | |
| First Time |
Parceljs
Parceljs parcel |
|
| CPE | cpe:2.3:a:parceljs:parcel:*:*:*:*:*:*:*:* cpe:2.3:a:parceljs:parcel:2.0.0:alpha0:*:*:*:*:*:* |
17 Sep 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-346 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
17 Sep 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-17 19:15
Updated : 2025-09-26 15:06
NVD link : CVE-2025-56648
Mitre link : CVE-2025-56648
CVE.ORG link : CVE-2025-56648
JSON object : View
Products Affected
parceljs
- parcel
CWE
CWE-346
Origin Validation Error