CVE-2025-56648

Published: Sep 17, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them.

Affected (2)

Products: Parceljs: Parcel

Parceljs

1 product

Parcel

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Parceljs Parcel	Up to 1.10.3
Parceljs Parcel	Version 2.0.0 alpha0

Related CWEs

CWE-346

Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

References (4)

https://gist.github.com/R4356th/41f468def606b2406e36f7193f5322b8

Source: cve@mitre.org

Exploit

https://github.com/parcel-bundler/parcel/commit/4bc56e3242a85491c7edf589966e9b44c6330c49

Source: cve@mitre.org

https://github.com/parcel-bundler/parcel/discussions/10089

Source: cve@mitre.org

Issue Tracking

https://github.com/parcel-bundler/parcel/issues/10216

Source: cve@mitre.org

ExploitIssue Tracking

Timeline

No history available yet.