CVE-2025-56647: 
JavaScript vulnerability analysis and mitigation

CVE-2025-56647 is a Missing Origin Validation in WebSocket vulnerability affecting the npm package @farmfe/core (Farm build tool) in all versions before 1.7.6. The Farm development server's Hot Module Reloading (HMR) WebSocket endpoint does not validate the Origin header of incoming connections, allowing any webpage visited by a developer to connect to the local HMR server and receive leaked source code. The vulnerability was reported on May 19, 2025, and publicly disclosed on February 12, 2026, with a patch released in version 1.7.6. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory).

The root cause is CWE-1385 (Missing Origin Validation in WebSockets): the Farm HMR server's isHMRRequest() method in packages/core/src/server/ws.ts only checked the URL path (/__hmr) and the sec-websocket-protocol header (farm_hmr), but never validated the Origin header of the WebSocket upgrade request. Because browsers do not enforce same-origin policy for WebSocket connections, a malicious webpage can initiate a WebSocket connection to ws://localhost:9000/__hmr from any origin. The attacker's page simply opens a WebSocket with the correct protocol identifier and receives HMR messages — which can include module source code — broadcast by the developer's local Farm server (Github Advisory, Researcher Gist). The fix, introduced in commit 83342ef, adds an allowlist of recognized origins (localhost and configured hostname/port) and rejects all connections with unrecognized Origin headers (Farm Commit).

Successful exploitation results in high confidentiality impact: an attacker can exfiltrate the developer's application source code as it is broadcast over the HMR WebSocket channel. This is limited to the development environment — production deployments are not affected — but stolen source code could expose proprietary business logic, API keys, credentials, or other sensitive data embedded in the codebase. There is no integrity or availability impact (Github Advisory).

A public proof-of-concept (PoC) was published by the reporter (R4356th) as part of the vulnerability disclosure, demonstrating a simple HTML page with JavaScript that connects to the Farm HMR WebSocket endpoint (Researcher Gist). Exploitation requires no privileges and only requires that the victim developer visit an attacker-controlled webpage while running farm dev. The EPSS score is approximately 0.015% (1st percentile), indicating low probability of automated exploitation in the near term. No in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Reconnaissance: Identify developers using the Farm build tool (@farmfe/core) who may be running farm dev locally, typically listening on ws://localhost:9000/__hmr by default.
2. Craft malicious webpage: Create an HTML page containing JavaScript that opens a WebSocket connection to the Farm HMR endpoint using the correct subprotocol: new WebSocket('ws://localhost:9000/__hmr', 'farm_hmr').
3. Lure the victim: Trick the target developer into visiting the attacker-controlled webpage (e.g., via phishing, malicious link, or compromised site) while they have farm dev running.
4. Receive HMR messages: The Farm server, lacking origin validation, accepts the WebSocket connection. The attacker's page listens for message events and captures all HMR broadcast data, which may include module source code.
5. Exfiltrate data: The attacker's page forwards received source code to a remote server (e.g., via fetch() or XMLHttpRequest) for collection and analysis (Researcher Gist, Farm Issue).

• Network: Unexpected WebSocket connections to ws://localhost:9000/__hmr (or configured HMR port) originating from browser tabs with non-localhost origins; outbound HTTP/S requests from the browser to unknown external domains shortly after visiting an unfamiliar site while farm dev is running.
• Logs: Farm dev server logs showing WebSocket upgrade requests from unexpected Origin headers (pre-patch versions will not log rejections; post-patch versions will reject and may log unrecognized origins).
• Browser: Browser developer tools showing an active WebSocket connection to the local Farm HMR endpoint initiated from a third-party webpage.

The primary remediation is to upgrade @farmfe/core to version 1.7.6 or later, which adds origin validation to the HMR WebSocket server (Github Advisory, Farm Commit). If upgrading immediately is not possible, developers should avoid visiting untrusted or unfamiliar websites while running farm dev. As an additional workaround, isolating the development environment behind a proxy or firewall that restricts access to the HMR port from external origins can reduce exposure (Researcher Gist).

The vulnerability was responsibly reported by researcher R4356th via a GitHub issue on May 19, 2025, and the Farm maintainers addressed it promptly with a patch merged via pull request #2173. The fix was noted as a breaking change for any external applications that previously connected to the HMR server from non-localhost origins, requiring those clients to update their configured ports and hosts (Farm Commit, Farm Issue). No significant broader media coverage or social media discussion has been identified.