CVE-2025-56647
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.2%
exploitation probability
0.2%top 90% of all CVEs
observed exploitation
nono source reports it
In short
The Farm development server doesn't check where WebSocket connections come from, allowing attackers to spy on developers and steal their source code through fake web pages.
Technical detail
Missing origin validation in the WebSocket server used for hot module reloading (HMR) in @farmfe/core before 1.7.6 allows cross-origin WebSocket connections. An attacker can serve a malicious webpage to a developer, establish an unauthorized WebSocket connection to the HMR server, and intercept source code transmitted over the unvalidated channel.
Summary generated and translated by AI from the official description.
npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leaked by the WebSocket server.
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:R
Affected products
n/a · n/a