Medium severity · published Sep 17, 2025
CVE-2025-56648
npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Parcel · Parceljs
through 1.10.3; 2.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-56648
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-56648
Exploit
https://gist.github.com/R4356th/41f468def606b2406e36f7193f5322b8
github.com
https://github.com/parcel-bundler/parcel/commit/4bc56e3242a85491c7edf589966e9b44c6330c49
Issue Tracking
https://github.com/parcel-bundler/parcel/discussions/10089
Exploit
https://github.com/parcel-bundler/parcel/issues/10216
More from Parcel
7.5
CVE-2018-14731
An issue was discovered in HMRServer.js in Parcel parcel-bundler