What’s Vulnerable › Vulnerabilities

CVE-2025-56647

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-12 · updated 2026-06-17
• Weakness: CWE-1385

Description

npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leaked by the WebSocket server.

References

• https://gist.github.com/R4356th/d4372c6f83275d583c180c0e7d7332af
• https://github.com/farm-fe/farm/commit/83342ef06e0aea37270950fd8c930422c4df0679
• https://github.com/farm-fe/farm/issues/2168

Get alerted when CVE-2025-56647 or the next vulnerability affects your stack