Vulnerability · Published Feb 12, 2026 · Assigned by mitre
CVE-2025-56647
Medium 6.5
In plain English
A medium-severity security flaw in the @farmfe/core package (npm). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leaked by the WebSocket server.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @farmfe/core | 1.7.6 | GHSA-p773-8mf4-rjm5 |
Affected products (as reported)
Weakness: CWE-1385 · Vector: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:R