CVE-2025-56647
CVE-2025-56647
In short
The Farm development server doesn't check where WebSocket connections come from, allowing attackers to spy on developers and steal their source code through fake web pages.
Technical detail
Missing origin validation in the WebSocket server used for hot module reloading (HMR) in @farmfe/core before 1.7.6 allows cross-origin WebSocket connections. An attacker can serve a malicious webpage to a developer, establish an unauthorized WebSocket connection to the HMR server, and intercept source code transmitted over the unvalidated channel.
Summary generated and translated by AI from the official description.
npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leaked by the WebSocket server.
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:R
Affected products
n/a · n/aWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →