Sensitive information sent insecurely In parcel-bundler
Description
Missing Origin Validation in parcel-bundler
Versions of parcel-bundler before 1.10.0 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.
Recommendation
Update to version 1.10.0 or later.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 npm | 1.10.0 | ||
npm | 1.10.0 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3. 4. 5. 6.