PT-2025-38252 · Parcel · Parcel

R4356Th · Published 2025-09-17 · Updated 2025-12-30 · CVE-2025-56648

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions parcel versions 2.0.0-alpha and earlier

Description A security issue exists in Parcel that allows malicious websites to send XMLHTTPRequests to the application's development server and read the response, potentially leading to source code theft when developers visit these websites. This occurs during developer activity while working on a project with the Parcel dev server running.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2025-56648

GHSA-QM9P-F9J5-W83W

Affected Products

Parcel

References · 16

• 🔥 https://github.com/parcel-bundler/parcel/issues/10216 · Exploit
• 🔥 https://gist.github.com/R4356th/41f468def606b2406e36f7193f5322b8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-56648 · Security Note
• https://osv.dev/vulnerability/CVE-2025-56648 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qm9p-f9j5-w83w · Vendor Advisory
• https://github.com/parcel-bundler/parcel/commit/9e2f6f1377123cff3b82f6dde4e20336efc846a1 · Note
• https://github.com/parcel-bundler/parcel/commit/4bc56e3242a85491c7edf589966e9b44c6330c49 · Note
• https://github.com/parcel-bundler/parcel/discussions/10089 · Note
• https://github.com/parcel-bundler/parcel/pull/10138 · Note
• https://github.com/parcel-bundler/parcel · Note
• https://twitter.com/redmin78/status/1968342902037438749 · Twitter Post
• https://twitter.com/threatcluster/status/2005942161905156140 · Twitter Post
• https://twitter.com/CVEnew/status/1969110933604843636 · Twitter Post
• https://twitter.com/redmin78/status/1968721600305328364 · Twitter Post
• https://t.me/cveNotify/135718 · Telegram Post