Missing Origin Validation

Overview

Versions of parcel-bundler before 1.10.0 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer’s source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.

Recommendation

Update to version 1.10.0 or later.

References

• [Sniffing Codes in Hot Module Reloading Messages
• ](https://blog.cal1.cn/post/Sniffing Codes in Hot Module Reloading Messages)
• GitHub Issue
• GitHub Pull Request
• GitHub Advisory