Missing Origin Validation

Overview

Versions of browserify-hmr prior to 0.4.0 are missing origin validation on the websocket server.

This vulnerability allows a remote attacker to steal a developer’s source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.

Recommendation

Upgrade to version 0.4.0 or later.

References

• [Sniffing Codes in Hot Module Reloading Messages
• ](https://blog.cal1.cn/post/Sniffing Codes in Hot Module Reloading Messages)
• GitHub Issue
• GitHub Advisory