GHSA-qm9p-f9j5-w83w

Suggest an improvement
Source
https://github.com/advisories/GHSA-qm9p-f9j5-w83w
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-qm9p-f9j5-w83w/GHSA-qm9p-f9j5-w83w.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qm9p-f9j5-w83w
Aliases
Published
2025-09-17T21:30:42Z
Modified
2026-04-13T19:02:07Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Parcel has an Origin Validation Error vulnerability
Details

parcel versions 1.6.1 and above have an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them. Version 2.16.4 supports a --no-cors option which disables CORS headers in the dev server.

Database specific 
{
    "cwe_ids":  [
        "CWE-346"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-09-18T17:15:13Z",
    "nvd_published_at":  "2025-09-17T19:15:46Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / @parcel/reporter-dev-server

Package

Name
@parcel/reporter-dev-server
View open source insights on deps.dev
Purl
pkg:npm/%40parcel/reporter-dev-server

Affected ranges

Type
SEMVER
Events
Introduced
1.6.1
Fixed
2.16.4

Database specific

last_known_affected_version_range 
"<= 2.16.3"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-qm9p-f9j5-w83w/GHSA-qm9p-f9j5-w83w.json"