@dailybruin/lux (>=1.0.0, <=1.0.4), @dsbn/slate (0.0.1) +18 more potentially affected by CVE-2018-14731 via parcel-bundler (>=1.2.0, <=1.9.7)

parcel-bundler NPM version =1.2.0, =1.0.0, =1.1.0, =0.2.5, =1.0.0-alpha.2, =1.0.0-alpha.2, =0.0.12, =1.2.1, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2018-14731 Source advisory: OSV:GHSA-37Q6-576Q-VGR7...

CVE-2018-14731

The provided connected advisory for parcel-bundler identifies a concrete defect: versions before 1.10.0 of parcel-bundler’s WebSocket server lack origin validation for HMR, allowing a remote attacker to steal a developer’s source code via ws:// connections. This is caused by missing validation of...