CVE-2025-56647 @farmfe/core is Missing Origin Validation in WebSocket
Attackers can steal source code and surveil developers by exploiting missing origin validation in the Farm development server's WebSocket connection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-56647?
CVE-2025-56647 is a medium-severity missing authorization vulnerability in n/a, published on 12 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leaked by the WebSocket server.
Weakness: CWE-1385
Which versions are affected by CVE-2025-56647?
2 open source packages ship an affected version, including @farmfe/core.
| Package | Affected | Fixed in |
|---|---|---|
@farmfe/core npm | All versions | 1.7.6 |
@farmfe/core npm | All versions | 1.7.6 |
How do I fix CVE-2025-56647?
Upgrade @farmfe/core to 1.7.6 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-56647 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-56647 exists.
Sources
Also known as GHSA-p773-8mf4-rjm5.