CVE-2025-56648 Parcel has an Origin Validation Error vulnerability
Attackers can steal source code from Parcel development servers via malicious websites due to missing origin validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-56648?
CVE-2025-56648 is a medium-severity missing authorization vulnerability in n/a, published on 17 Sep 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them.
Weakness: CWE-346
Which versions are affected by CVE-2025-56648?
2 open source packages ship an affected version, including @parcel/reporter-dev-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@parcel/reporter-dev-server npm | From 1.6.1 | 2.16.4 |
@parcel/reporter-dev-server npm | From 1.6.1 | 2.16.4 |
Products include Parceljs Parcel.
How do I fix CVE-2025-56648?
Upgrade @parcel/reporter-dev-server to 2.16.4 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-56648 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-56648 exists.
Other vulnerabilities in n/a
Sources
Also known as CLSA-2026-1793296891, GHSA-qm9p-f9j5-w83w.