Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-56648

Good to know:

icon

Date: September 16, 2025

npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them.

Severity Score

Related Resources (7)

https://github.com/parcel-bundler/parcel/discussions/10089
https://github.com/parcel-bundler/parcel/pull/10138
https://nvd.nist.gov/vuln/detail/CVE-2025-56648
https://github.com/parcel-bundler/parcel/issues/10216
https://gist.github.com/R4356th/41f468def606b2406e36f7193f5322b8
https://github.com/parcel-bundler/parcel
https://www.mend.io/vulnerability-database/CVE-2025-56648

Severity Score

Weakness Type (CWE)

Origin Validation Error

CWE-346

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us