MEDIUM6.5

GHSA-qm9p-f9j5-w83w

Parcel has an Origin Validation Error vulnerability

Quick fix

GHSA-qm9p-f9j5-w83w — @parcel/reporter-dev-server: upgrade to the fixed version with the command below.

npm install @parcel/reporter-dev-server@2.16.4

Details

parcel versions 1.6.1 and above have an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them. Version 2.16.4 supports a `--no-cors` option which disables CORS headers in the dev server.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@parcel/reporter-dev-server

Introduced in: 1.6.1Fixed in: 2.16.4

Fixnpm install @parcel/reporter-dev-server@2.16.4

References

https://nvd.nist.gov/vuln/detail/CVE-2025-56648[ADVISORY]
https://github.com/parcel-bundler/parcel/issues/10216[WEB]
https://github.com/parcel-bundler/parcel/pull/10138[WEB]
https://github.com/parcel-bundler/parcel/commit/4bc56e3242a85491c7edf589966e9b44c6330c49[WEB]
https://github.com/parcel-bundler/parcel/commit/9e2f6f1377123cff3b82f6dde4e20336efc846a1[WEB]
https://gist.github.com/R4356th/41f468def606b2406e36f7193f5322b8[WEB]
https://github.com/parcel-bundler/parcel[PACKAGE]
https://github.com/parcel-bundler/parcel/discussions/10089[WEB]