Medium
Security advisory
npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-56648
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 23:24 UTC · Revision 1
Source evidence
npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them.
osv:CVE-2025-56648
Complete source record
{
"id": "3375b398c6c5da769817f207172077a669c8450126ebac7e4bb1579ddd6ed961",
"url": "https://osv.dev/vulnerability/CVE-2025-56648",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2025-56648",
"summary": "npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them.",
"evidence": "osv:CVE-2025-56648",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-56648",
"aliases": [
"CVE-2025-56648",
"GHSA-qm9p-f9j5-w83w"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/parcel-bundler/parcel",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "4bc56e3242a85491c7edf589966e9b44c6330c49"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:parceljs:parcel:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.10.3"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "4bc56e3242a85491c7edf589966e9b44c6330c49"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v2.14.4",
"v2.14.3",
"v2.14.2",
"v2.14.1",
"v2.14.0",
"v2.13.3",
"v2.13.2",
"v2.13.1",
"v2.13.0",
"v2.12.0",
"v2.11.0",
"v2.10.3",
"v2.10.2",
"v2.10.1",
"v2.10.0",
"v2.9.3",
"v2.9.2",
"v2.9.1",
"v2.9.0",
"v2.8.3",
"v2.8.2",
"v2.8.1",
"v2.8.0",
"v2.7.0",
"v2.6.2",
"v2.6.1",
"v2.6.0",
"v2.5.0",
"v2.4.1",
"v2.4.0",
"v2.3.2",
"v2.3.1",
"v2.3.0",
"v2.2.1",
"v2.2.0",
"v2.1.1",
"v2.1.0",
"v2.0.1",
"v2.0.0",
"v2.0.0-rc.0",
"v2.0.0-beta.3.1",
"v2.0.0-beta.3",
"v2.0.0-beta.2",
"v2.0.0-beta.1",
"parcel@2.0.0-alpha.3.2",
"@parcel/ts-typecheck-example@2.0.0-alpha.3.2",
"@parcel/ts-example@2.0.0-alpha.3.2",
"@parcel/test-utils@2.0.0-alpha.3.2",
"@parcel/simple-example@2.0.0-alpha.3.2",
"@parcel/register@2.0.0-alpha.3.2",
"@parcel/react-refresh-example@2.0.0-alpha.3.2",
"@parcel/react-hmr-example@2.0.0-alpha.3.2",
"@parcel/kitchen-sink-example@2.0.0-alpha.3.2",
"@parcel/is-v2-ready-yet@2.0.0-alpha.3.2",
"@parcel/integration-tests@2.0.0-alpha.3.2",
"@parcel/html-example@2.0.0-alpha.3.2",
"@parcel/eslint-example@2.0.0-alpha.3.2",
"@parcel/core@2.0.0-alpha.3.2",
"parcel@2.0.0-alpha.3.1",
"parcel-bundler@2.0.0-alpha.3.1",
"@parcel/workers@2.0.0-alpha.3.1",
"@parcel/validator-typescript@2.0.0-alpha.3.1",
"@parcel/validator-eslint@2.0.0-alpha.3.1",
"@parcel/utils@2.0.0-alpha.3.1",
"@parcel/types@2.0.0-alpha.3.1",
"@parcel/ts-utils@2.0.0-alpha.3.1",
"@parcel/ts-typecheck-example@2.0.0-alpha.3.1",
"@parcel/ts-example@2.0.0-alpha.3.1",
"@parcel/transformer-yaml@2.0.0-alpha.3.1",
"@parcel/transformer-typescript-types@2.0.0-alpha.3.1",
"@parcel/transformer-typescript-tsc@2.0.0-alpha.3.1",
"@parcel/transformer-toml@2.0.0-alpha.3.1",
"@parcel/transformer-sugarss@2.0.0-alpha.3.1",
"@parcel/transformer-stylus@2.0.0-alpha.3.1",
"@parcel/transformer-sass@2.0.0-alpha.3.1",
"@parcel/transformer-react-refresh-wrap@2.0.0-alpha.3.1",
"@parcel/transformer-react-refresh-babel@2.0.0-alpha.3.1",
"@parcel/transformer-raw@2.0.0-alpha.3.1",
"@parcel/transformer-pug@2.0.0-alpha.3.1",
"@parcel/transformer-posthtml@2.0.0-alpha.3.1",
"@parcel/transformer-postcss@2.0.0-alpha.3.1",
"@parcel/transformer-less@2.0.0-alpha.3.1",
"@parcel/transformer-json@2.0.0-alpha.3.1",
"@parcel/transformer-js@2.0.0-alpha.3.1",
"@parcel/transformer-inline@2.0.0-alpha.3.1",
"@parcel/transformer-inline-string@2.0.0-alpha.3.1",
"@parcel/transformer-html@2.0.0-alpha.3.1",
"@parcel/transformer-graphql@2.0.0-alpha.3.1",
"@parcel/transformer-css@2.0.0-alpha.3.1",
"@parcel/transformer-coffeescript@2.0.0-alpha.3.1",
"@parcel/transformer-babel@2.0.0-alpha.3.1",
"@parcel/test-utils@2.0.0-alpha.3.1",
"@parcel/source-map@2.0.0-alpha.3.1",
"@parcel/simple-example@2.0.0-alpha.3.1",
"@parcel/scope-hoisting@2.0.0-alpha.3.1",
"@parcel/runtime-react-refresh@2.0.0-alpha.3.1",
"@parcel/runtime-js@2.0.0-alpha.3.1",
"@parcel/runtime-browser-hmr@2.0.0-alpha.3.1",
"@parcel/resolver-default@2.0.0-alpha.3.1",
"@parcel/reporter-json@2.0.0-alpha.3.1",
"@parcel/reporter-hmr-server@2.0.0-alpha.3.1",
"@parcel/reporter-dev-server@2.0.0-alpha.3.1",
"@parcel/reporter-cli@2.0.0-alpha.3.1",
"@parcel/reporter-build-metrics@2.0.0-alpha.3.1",
"@parcel/register@2.0.0-alpha.3.1",
"@parcel/react-refresh-example@2.0.0-alpha.3.1",
"@parcel/react-hmr-example@2.0.0-alpha.3.1",
"@parcel/plugin@2.0.0-alpha.3.1",
"@parcel/packager-ts@2.0.0-alpha.3.1",
"@parcel/packager-raw@2.0.0-alpha.3.1",
"@parcel/packager-js@2.0.0-alpha.3.1",
"@parcel/packager-html@2.0.0-alpha.3.1",
"@parcel/packager-css@2.0.0-alpha.3.1",
"@parcel/package-manager@2.0.0-alpha.3.1",
"@parcel/optimizer-terser@2.0.0-alpha.3.1",
"@parcel/optimizer-htmlnano@2.0.0-alpha.3.1",
"@parcel/optimizer-data-url@2.0.0-alpha.3.1",
"@parcel/optimizer-cssnano@2.0.0-alpha.3.1",
"@parcel/optimizer-blob-url@2.0.0-alpha.3.1",
"@parcel/namer-default@2.0.0-alpha.3.1",
"@parcel/markdown-ansi@2.0.0-alpha.3.1",
"@parcel/logger@2.0.0-alpha.3.1",
"@parcel/kitchen-sink-example@2.0.0-alpha.3.1",
"@parcel/is-v2-ready-yet@2.0.0-alpha.3.1",
"@parcel/integration-tests@2.0.0-alpha.3.1",
"@parcel/html-example@2.0.0-alpha.3.1",
"@parcel/fs@2.0.0-alpha.3.1",
"@parcel/events@2.0.0-alpha.3.1",
"@parcel/eslint-plugin@2.0.0-alpha.3.1",
"@parcel/eslint-example@2.0.0-alpha.3.1",
"@parcel/eslint-config@2.0.0-alpha.3.1",
"@parcel/eslint-config-browser@2.0.0-alpha.3.1",
"@parcel/diagnostic@2.0.0-alpha.3.1",
"@parcel/core@2.0.0-alpha.3.1",
"@parcel/config-default@2.0.0-alpha.3.1",
"@parcel/codeframe@2.0.0-alpha.3.1",
"@parcel/cache@2.0.0-alpha.3.1",
"@parcel/bundler-default@2.0.0-alpha.3.1",
"@parcel/babel-register@2.0.0-alpha.3.1",
"@parcel/babel-preset@2.0.0-alpha.3.1",
"@parcel/babel-preset-env@2.0.0-alpha.3.1",
"parcel@2.0.0-alpha.3",
"parcel-bundler@2.0.0-alpha.3",
"@parcel/workers@2.0.0-alpha.3",
"@parcel/validator-typescript@2.0.0-alpha.3",
"@parcel/validator-eslint@2.0.0-alpha.3",
"@parcel/utils@2.0.0-alpha.3",
"@parcel/types@2.0.0-alpha.3",
"@parcel/ts-utils@2.0.0-alpha.3",
"@parcel/ts-typecheck-example@2.0.0-alpha.3",
"@parcel/ts-example@2.0.0-alpha.3",
"@parcel/transformer-yaml@2.0.0-alpha.3",
"@parcel/transformer-typescript-types@2.0.0-alpha.3",
"@parcel/transformer-typescript-tsc@2.0.0-alpha.3",
"@parcel/transformer-toml@2.0.0-alpha.3",
"@parcel/transformer-sugarss@2.0.0-alpha.3",
"@parcel/transformer-stylus@2.0.0-alpha.3",
"@parcel/transformer-sass@2.0.0-alpha.3",
"@parcel/transformer-react-refresh-wrap@2.0.0-alpha.3",
"@parcel/transformer-react-refresh-babel@2.0.0-alpha.3",
"@parcel/transformer-raw@2.0.0-alpha.3",
"@parcel/transformer-pug@2.0.0-alpha.3",
"@parcel/transformer-posthtml@2.0.0-alpha.3",
"@parcel/transformer-postcss@2.0.0-alpha.3",
"@parcel/transformer-less@2.0.0-alpha.3",
"@parcel/transformer-json@2.0.0-alpha.3",
"@parcel/transformer-js@2.0.0-alpha.3",
"@parcel/transformer-inline@2.0.0-alpha.3",
"@parcel/transformer-inline-string@2.0.0-alpha.3",
"@parcel/transformer-html@2.0.0-alpha.3",
"@parcel/transformer-graphql@2.0.0-alpha.3",
"@parcel/transformer-css@2.0.0-alpha.3",
"@parcel/transformer-coffeescript@2.0.0-alpha.3",
"@parcel/transformer-babel@2.0.0-alpha.3",
"@parcel/test-utils@2.0.0-alpha.3",
"@parcel/source-map@2.0.0-alpha.3",
"@parcel/simple-example@2.0.0-alpha.3",
"@parcel/scope-hoisting@2.0.0-alpha.3",
"@parcel/runtime-react-refresh@2.0.0-alpha.3",
"@parcel/runtime-js@2.0.0-alpha.3",
"@parcel/runtime-browser-hmr@2.0.0-alpha.3",
"@parcel/resolver-default@2.0.0-alpha.3",
"@parcel/reporter-json@2.0.0-alpha.3",
"@parcel/reporter-hmr-server@2.0.0-alpha.3",
"@parcel/reporter-dev-server@2.0.0-alpha.3",
"@parcel/reporter-cli@2.0.0-alpha.3",
"@parcel/reporter-build-metrics@2.0.0-alpha.3",
"@parcel/register@2.0.0-alpha.3",
"@parcel/react-refresh-example@2.0.0-alpha.3",
"@parcel/react-hmr-example@2.0.0-alpha.3",
"@parcel/plugin@2.0.0-alpha.3",
"@parcel/packager-ts@2.0.0-alpha.3",
"@parcel/packager-raw@2.0.0-alpha.3",
"@parcel/packager-js@2.0.0-alpha.3",
"@parcel/packager-html@2.0.0-alpha.3",
"@parcel/packager-css@2.0.0-alpha.3",
"@parcel/package-manager@2.0.0-alpha.3",
"@parcel/optimizer-terser@2.0.0-alpha.3",
"@parcel/optimizer-htmlnano@2.0.0-alpha.3",
"@parcel/optimizer-data-url@2.0.0-alpha.3",
"@parcel/optimizer-cssnano@2.0.0-alpha.3",
"@parcel/optimizer-blob-url@2.0.0-alpha.3",
"@parcel/namer-default@2.0.0-alpha.3",
"@parcel/markdown-ansi@2.0.0-alpha.3",
"@parcel/logger@2.0.0-alpha.3",
"@parcel/kitchen-sink-example@2.0.0-alpha.3",
"@parcel/is-v2-ready-yet@2.0.0-alpha.3",
"@parcel/integration-tests@2.0.0-alpha.3",
"@parcel/html-example@2.0.0-alpha.3",
"@parcel/fs@2.0.0-alpha.3",
"@parcel/events@2.0.0-alpha.3",
"@parcel/eslint-plugin@2.0.0-alpha.3",
"@parcel/eslint-example@2.0.0-alpha.3",
"@parcel/eslint-config@2.0.0-alpha.3",
"@parcel/eslint-config-browser@2.0.0-alpha.3",
"@parcel/diagnostic@2.0.0-alpha.3",
"@parcel/core@2.0.0-alpha.3",
"@parcel/config-default@2.0.0-alpha.3",
"@parcel/codeframe@2.0.0-alpha.3",
"@parcel/cache@2.0.0-alpha.3",
"@parcel/bundler-default@2.0.0-alpha.3",
"@parcel/babel-register@2.0.0-alpha.3",
"@parcel/babel-preset@2.0.0-alpha.3",
"@parcel/babel-preset-env@2.0.0-alpha.3",
"parcel@2.0.0-alpha.2.1",
"parcel-bundler@2.0.0-alpha.2.1",
"@parcel/workers@2.0.0-alpha.2.1",
"@parcel/validator-typescript@2.0.0-alpha.2.1",
"@parcel/validator-eslint@2.0.0-alpha.2.1",
"@parcel/utils@2.0.0-alpha.2.1",
"@parcel/types@2.0.0-alpha.2.1",
"@parcel/ts-typecheck-example@2.0.0-alpha.2.1",
"@parcel/ts-example@2.0.0-alpha.2.1",
"@parcel/transformer-yaml@2.0.0-alpha.2.1",
"@parcel/transformer-typescript-types@2.0.0-alpha.2.1",
"@parcel/transformer-typescript-tsc@2.0.0-alpha.2.1",
"@parcel/transformer-toml@2.0.0-alpha.2.1",
"@parcel/transformer-sugarss@2.0.0-alpha.2.1",
"@parcel/transformer-stylus@2.0.0-alpha.2.1",
"@parcel/transformer-sass@2.0.0-alpha.2.1",
"@parcel/transformer-raw@2.0.0-alpha.2.1",
"@parcel/transformer-pug@2.0.0-alpha.2.1",
"@parcel/transformer-posthtml@2.0.0-alpha.2.1",
"@parcel/transformer-postcss@2.0.0-alpha.2.1",
"@parcel/transformer-less@2.0.0-alpha.2.1",
"@parcel/transformer-json@2.0.0-alpha.2.1",
"@parcel/transformer-js@2.0.0-alpha.2.1",
"@parcel/transformer-html@2.0.0-alpha.2.1",
"@parcel/transformer-css@2.0.0-alpha.2.1",
"@parcel/transformer-coffeescript@2.0.0-alpha.2.1",
"@parcel/transformer-babel@2.0.0-alpha.2.1",
"@parcel/test-utils@2.0.0-alpha.2.1",
"@parcel/source-map@2.0.0-alpha.2.1",
"@parcel/simple-example@2.0.0-alpha.2.1",
"@parcel/scope-hoisting@2.0.0-alpha.2.1",
"@parcel/runtime-js@2.0.0-alpha.2.1",
"@parcel/runtime-browser-hmr@2.0.0-alpha.2.1",
"@parcel/resolver-default@2.0.0-alpha.2.1",
"@parcel/reporter-json@2.0.0-alpha.2.1",
"@parcel/reporter-hmr-server@2.0.0-alpha.2.1",
"@parcel/reporter-dev-server@2.0.0-alpha.2.1",
"@parcel/reporter-cli@2.0.0-alpha.2.1",
"@parcel/reporter-build-metrics@2.0.0-alpha.2.1",
"@parcel/register@2.0.0-alpha.2.1",
"@parcel/react-hmr-example@2.0.0-alpha.2.1",
"@parcel/plugin@2.0.0-alpha.2.1",
"@parcel/packager-ts@2.0.0-alpha.2.1",
"@parcel/packager-raw@2.0.0-alpha.2.1",
"@parcel/packager-js@2.0.0-alpha.2.1",
"@parcel/packager-html@2.0.0-alpha.2.1",
"@parcel/packager-css@2.0.0-alpha.2.1",
"@parcel/package-manager@2.0.0-alpha.2.1",
"@parcel/optimizer-terser@2.0.0-alpha.2.1",
"@parcel/optimizer-cssnano@2.0.0-alpha.2.1",
"@parcel/namer-default@2.0.0-alpha.2.1",
"@parcel/logger@2.0.0-alpha.2.1",
"@parcel/kitchen-sink-example@2.0.0-alpha.2.1",
"@parcel/is-v2-ready-yet@2.0.0-alpha.2.1",
"@parcel/integration-tests@2.0.0-alpha.2.1",
"@parcel/html-example@2.0.0-alpha.2.1",
"@parcel/fs@2.0.0-alpha.2.1",
"@parcel/events@2.0.0-alpha.2.1",
"@parcel/eslint-plugin@2.0.0-alpha.2.1",
"@parcel/eslint-example@2.0.0-alpha.2.1",
"@parcel/eslint-config@2.0.0-alpha.2.1",
"@parcel/eslint-config-browser@2.0.0-alpha.2.1",
"@parcel/core@2.0.0-alpha.2.1",
"@parcel/config-default@2.0.0-alpha.2.1",
"@parcel/cache@2.0.0-alpha.2.1",
"@parcel/bundler-default@2.0.0-alpha.2.1",
"@parcel/babel-register@2.0.0-alpha.2.1",
"@parcel/babel-preset@2.0.0-alpha.2.1",
"@parcel/babel-preset-env@2.0.0-alpha.2.1",
"parcel@2.0.0-alpha.2",
"parcel-bundler@2.0.0-alpha.2",
"@parcel/workers@2.0.0-alpha.2",
"@parcel/validator-typescript@2.0.0-alpha.2",
"@parcel/validator-eslint@2.0.0-alpha.2",
"@parcel/utils@2.0.0-alpha.2",
"@parcel/types@2.0.0-alpha.2",
"@parcel/ts-typecheck-example@2.0.0-alpha.2",
"@parcel/ts-example@2.0.0-alpha.2",
"@parcel/transformer-yaml@2.0.0-alpha.2",
"@parcel/transformer-typescript-types@2.0.0-alpha.2",
"@parcel/transformer-typescript-tsc@2.0.0-alpha.2",
"@parcel/transformer-toml@2.0.0-alpha.2",
"@parcel/transformer-sugarss@2.0.0-alpha.2",
"@parcel/transformer-stylus@2.0.0-alpha.2",
"@parcel/transformer-sass@2.0.0-alpha.2",
"@parcel/transformer-raw@2.0.0-alpha.2",
"@parcel/transformer-pug@2.0.0-alpha.2",
"@parcel/transformer-posthtml@2.0.0-alpha.2",
"@parcel/transformer-postcss@2.0.0-alpha.2",
"@parcel/transformer-less@2.0.0-alpha.2",
"@parcel/transformer-json@2.0.0-alpha.2",
"@parcel/transformer-js@2.0.0-alpha.2",
"@parcel/transformer-html@2.0.0-alpha.2",
"@parcel/transformer-css@2.0.0-alpha.2",
"@parcel/transformer-coffeescript@2.0.0-alpha.2",
"@parcel/transformer-babel@2.0.0-alpha.2",
"@parcel/test-utils@2.0.0-alpha.2",
"@parcel/source-map@2.0.0-alpha.2",
"@parcel/simple-example@2.0.0-alpha.2",
"@parcel/scope-hoisting@2.0.0-alpha.2",
"@parcel/runtime-js@2.0.0-alpha.2",
"@parcel/runtime-browser-hmr@2.0.0-alpha.2",
"@parcel/resolver-default@2.0.0-alpha.2",
"@parcel/reporter-json@2.0.0-alpha.2",
"@parcel/reporter-hmr-server@2.0.0-alpha.2",
"@parcel/reporter-dev-server@2.0.0-alpha.2",
"@parcel/reporter-cli@2.0.0-alpha.2",
"@parcel/reporter-build-metrics@2.0.0-alpha.2",
"@parcel/register@2.0.0-alpha.2",
"@parcel/react-hmr-example@2.0.0-alpha.2",
"@parcel/plugin@2.0.0-alpha.2",
"@parcel/packager-ts@2.0.0-alpha.2",
"@parcel/packager-raw@2.0.0-alpha.2",
"@parcel/packager-js@2.0.0-alpha.2",
"@parcel/packager-html@2.0.0-alpha.2",
"@parcel/packager-css@2.0.0-alpha.2",
"@parcel/package-manager@2.0.0-alpha.2",
"@parcel/optimizer-terser@2.0.0-alpha.2",
"@parcel/optimizer-cssnano@2.0.0-alpha.2",
"@parcel/namer-default@2.0.0-alpha.2",
"@parcel/logger@2.0.0-alpha.2",
"@parcel/kitchen-sink-example@2.0.0-alpha.2",
"@parcel/is-v2-ready-yet@2.0.0-alpha.2",
"@parcel/integration-tests@2.0.0-alpha.2",
"@parcel/html-example@2.0.0-alpha.2",
"@parcel/fs@2.0.0-alpha.2",
"@parcel/events@2.0.0-alpha.2",
"@parcel/eslint-plugin@2.0.0-alpha.2",
"@parcel/eslint-example@2.0.0-alpha.2",
"@parcel/eslint-config@2.0.0-alpha.2",
"@parcel/eslint-config-browser@2.0.0-alpha.2",
"@parcel/core@2.0.0-alpha.2",
"@parcel/config-default@2.0.0-alpha.2",
"@parcel/cache@2.0.0-alpha.2",
"@parcel/bundler-default@2.0.0-alpha.2",
"@parcel/babel-register@2.0.0-alpha.2",
"@parcel/babel-preset@2.0.0-alpha.2",
"@parcel/babel-preset-env@2.0.0-alpha.2",
"parcel@2.0.0-alpha.1",
"parcel-bundler@1.12.4-alpha.0",
"@parcel/workers@2.0.0-alpha.1",
"@parcel/validator-typescript@2.0.0-alpha.1",
"@parcel/utils@2.0.0-alpha.1",
"@parcel/types@2.0.0-alpha.1",
"@parcel/ts-typecheck-example@2.0.0-alpha.1",
"@parcel/ts-example@2.0.0-alpha.1",
"@parcel/transformer-typescript-tsc@2.0.0-alpha.1",
"@parcel/transformer-stylus@2.0.0-alpha.1",
"@parcel/transformer-raw@2.0.0-alpha.1",
"@parcel/transformer-posthtml@2.0.0-alpha.1",
"@parcel/transformer-postcss@2.0.0-alpha.1",
"@parcel/transformer-json@2.0.0-alpha.1",
"@parcel/transformer-js@2.0.0-alpha.1",
"@parcel/transformer-html@2.0.0-alpha.1",
"@parcel/transformer-css@2.0.0-alpha.1",
"@parcel/transformer-coffeescript@2.0.0-alpha.1",
"@parcel/transformer-babel@2.0.0-alpha.1",
"@parcel/test-utils@2.0.0-alpha.1",
"@parcel/source-map@2.0.0-alpha.1",
"@parcel/simple-example@2.0.0-alpha.1",
"@parcel/scope-hoisting@2.0.0-alpha.1",
"@parcel/runtime-js@2.0.0-alpha.1",
"@parcel/runtime-browser-hmr@2.0.0-alpha.1",
"@parcel/resolver-default@2.0.0-alpha.1",
"@parcel/reporter-json@2.0.0-alpha.1",
"@parcel/reporter-hmr-server@2.0.0-alpha.1",
"@parcel/reporter-dev-server@2.0.0-alpha.1",
"@parcel/reporter-cli@2.0.0-alpha.1",
"@parcel/register@2.0.0-alpha.1",
"@parcel/react-hmr-example@2.0.0-alpha.1",
"@parcel/plugin@2.0.0-alpha.1",
"@parcel/packager-raw@2.0.0-alpha.1",
"@parcel/packager-js@2.0.0-alpha.1",
"@parcel/packager-html@2.0.0-alpha.1",
"@parcel/packager-css@2.0.0-alpha.1",
"@parcel/optimizer-terser@2.0.0-alpha.1",
"@parcel/optimizer-cssnano@2.0.1-alpha.0",
"@parcel/namer-default@2.0.0-alpha.1",
"@parcel/logger@2.0.0-alpha.1",
"@parcel/local-require@2.0.0-alpha.1",
"@parcel/kitchen-sink-example@2.0.0-alpha.1",
"@parcel/is-v2-ready-yet@2.0.0-alpha.1",
"@parcel/integration-tests@2.0.0-alpha.1",
"@parcel/install-package@2.0.0-alpha.1",
"@parcel/html-example@2.0.0-alpha.1",
"@parcel/fs@2.0.0-alpha.1",
"@parcel/events@2.0.0-alpha.1",
"@parcel/eslint-plugin@2.0.0-alpha.1",
"@parcel/eslint-config@1.10.4-alpha.0",
"@parcel/eslint-config-browser@2.0.0-alpha.1",
"@parcel/core@2.0.0-alpha.1",
"@parcel/config-default@2.0.0-alpha.1",
"@parcel/cache@2.0.0-alpha.1",
"@parcel/bundler-default@2.0.0-alpha.1",
"@parcel/babel-register@2.0.0-alpha.1",
"@parcel/babel-preset@2.0.0-alpha.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-56648.json"
}
}
],
"modified": "2026-10-28T02:30:24.525718998Z",
"provider": "osv",
"references": [
"https://gist.github.com/R4356th/41f468def606b2406e36f7193f5322b8",
"https://github.com/parcel-bundler/parcel/discussions/10089",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/56xxx/CVE-2025-56648.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-56648",
"https://github.com/parcel-bundler/parcel/issues/10216",
"https://github.com/parcel-bundler/parcel/commit/4bc56e3242a85491c7edf589966e9b44c6330c49"
],
"provider_metadata": {
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/56xxx/CVE-2025-56648.json"
}
},
"related_cves": [
{
"value": "CVE-2025-56648",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 490868,
"published_at": "2025-09-17T00:00:00+00:00"
}