« Volver al listado

CVE-2025-56648

Estado: ModificadaMedia (6.5)—

npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Parceljs — Parcel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-56648",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-56648",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-17T19:18:57.975596Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-09-17T19:15:46.963",
  "references": [
    {
      "url": "https://gist.github.com/R4356th/41f468def606b2406e36f7193f5322b8",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/parcel-bundler/parcel/commit/4bc56e3242a85491c7edf589966e9b44c6330c49",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/parcel-bundler/parcel/discussions/10089",
      "tags": [
        "Issue Tracking"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/parcel-bundler/parcel/issues/10216",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them."
    },
    {
      "lang": "es",
      "value": "npm parcel 2.0.0-alpha y anteriores tiene una vulnerabilidad de error de validación de origen. Sitios web maliciosos pueden enviar XMLHTTPRequests al servidor de desarrollo de la aplicación y leer la respuesta para robar código fuente cuando los desarrolladores los visitan."
    }
  ],
  "lastModified": "2026-06-17T09:42:42.740",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:parceljs:parcel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBC5650B-9070-49A9-85B6-24C780E59C78",
              "versionEndIncluding": "1.10.3"
            },
            {
              "criteria": "cpe:2.3:a:parceljs:parcel:2.0.0:alpha0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16D33281-5F1D-47B8-9ABD-D01A8931FED0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}