Skip to content

Vendor

parceljs vulnerabilities

2 published CVES affecting parceljs, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of parceljs alerts

Products

Latest parceljs CVEs

Newest publication first

  1. CVE-2025-56648 Parcel has an Origin Validation Error vulnerability

    Published
    MediumCVSS 6.5

    npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them.

  2. CVE-2018-14731 Missing Origin Validation in parcel-bundler

    Published
    HighCVSS 7.5 EPSS 2.3%

    An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the Web...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.