CVE-2025-56647
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.2%
In short
The Farm development server doesn't check where WebSocket connections come from, allowing attackers to spy on developers and steal their source code through fake web pages.
Technical detail
Missing origin validation in the WebSocket server used for hot module reloading (HMR) in @farmfe/core before 1.7.6 allows cross-origin WebSocket connections. An attacker can serve a malicious webpage to a developer, establish an unauthorized WebSocket connection to the HMR server, and intercept source code transmitted over the unvalidated channel.
Summary generated and translated by AI from the official description.
npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leaked by the WebSocket server.
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:R
Affected products
n/a · n/a