CVE-2025-56648

NVD	https://nvd.nist.gov/vuln/detail/CVE-2025-56648
CWE	https://cwe.mitre.org/data/definitions/346.html

npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the applications development server and read the response to steal source code when developers visit them.

Weakness

The product does not properly verify that the source of data or communication is valid.

https://cwe.mitre.org/data/definitions/111.html
https://cwe.mitre.org/data/definitions/141.html
https://cwe.mitre.org/data/definitions/142.html
https://cwe.mitre.org/data/definitions/160.html
https://cwe.mitre.org/data/definitions/21.html
https://cwe.mitre.org/data/definitions/384.html
https://cwe.mitre.org/data/definitions/385.html
https://cwe.mitre.org/data/definitions/386.html
https://cwe.mitre.org/data/definitions/387.html
https://cwe.mitre.org/data/definitions/388.html
https://cwe.mitre.org/data/definitions/510.html
https://cwe.mitre.org/data/definitions/59.html
https://cwe.mitre.org/data/definitions/60.html
https://cwe.mitre.org/data/definitions/75.html
https://cwe.mitre.org/data/definitions/76.html
https://cwe.mitre.org/data/definitions/89.html

References

https://gist.github.com/R4356th/41f468def606b2406e36f7193f5322b8
https://github.com/parcel-bundler/parcel/discussions/10089
https://github.com/parcel-bundler/parcel/issues/10216

Origin Validation Error

Weakness

Related Attack Patterns

References