CVE-2025-56647
Medium · 6.5CVSS
6.5
EPSS
0.2%
Published
Feb 12, 2026
CISA due date
—
The record
npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leaked by the WebSocket server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @farmfe/core | 0 | 1.7.6 |
Related vulnerabilities
- GHSA-p773-8mf4-rjm5 @farmfe/core is Missing Origin Validation in WebSocket Same vulnerability
- CVE-2026-85183 Taipy configures its socket.io server with wildcard CORS origin and credential flag… CWE-1385
- CVE-2026-59950 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context… CWE-1385
- CVE-2026-57111 Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest… CWE-1385
- CVE-2026-10054 In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes… CWE-1385
- CVE-2026-44211 Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. CWE-1385
- CVE-2026-44514 Kubetail is a real-time logging dashboard for Kubernetes. CWE-1385
- GHSA-5c57-rqjx-35g2 Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability CWE-1385