CVE-2025-56648
Last modified
CVE-2025-56648 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them.. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Parceljs | Parcel | <= 1.10.3 | — |
| Parceljs | Parcel | 2.0.0 | Alpha0 |
References
- https://github.com/parcel-bundler/parcel/issues/10216Exploit, Issue Tracking
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2025-56648?
How severe is CVE-2025-56648?
How do I fix CVE-2025-56648?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-5662A deserialization vulnerability exists in the H2O-3 REST API…9.8
- CVE-2025-5663A vulnerability has been found in PHPGurukul Auto Taxi Stand…9.8
- CVE-2025-56630FoxCMS v1.2.5 and before is vulnerable to SQL Injection via …7.3
- CVE-2025-5664A vulnerability was found in FreeFloat FTP Server 1.0 and cl…9.8
- CVE-2025-56643Requarks Wiki.js 2.5.307 does not properly revoke or invalid…9.1
- CVE-2025-56647npm @farmfe/core before 1.7.6 is Missing Origin Validation i…6.5
- CVE-2025-5665A vulnerability was found in FreeFloat FTP Server 1.0. It ha…9.8
- CVE-2025-5666A vulnerability was found in FreeFloat FTP Server 1.0. It ha…9.8
- CVE-2025-5667A vulnerability was found in FreeFloat FTP Server 1.0. It ha…9.8
- CVE-2025-56675The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_2023053…3.5
- CVE-2025-56676TitanSystems Zender v3.9.7 contains an account takeover vuln…5.4
- CVE-2025-5668A vulnerability classified as critical has been found in PHP…8.8
Are you affected by CVE-2025-56648?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST