CVE-2018-14731

Name of the Vulnerable Software and Affected Versions parcel-bundler versions prior to 1.10.0

Description An issue in HMRServer.js allows attackers to steal a developer's code due to the lack of origin validation on the WebSocket server used for Hot Module Replacement (HMR). This enables anyone to receive HMR messages sent by the WebSocket server via a ws://127.0.0.1 connection from any origin. The vulnerability can be exploited by finding the random TCP port number used by the WebSocket server, which can be discovered by connecting to http://127.0.0.1 and examining the source code for the "new WebSocket" line.

Recommendations Update to version 1.10.0 or later. As a temporary workaround, consider restricting access to the WebSocket server used for HMR to minimize the risk of exploitation.