Executive brief
@farmfe/core is a JavaScript build tool and module bundler used by developers during application development. The development server's WebSocket feature fails to validate the origin of incoming connections, allowing attackers to intercept source code and sensitive project information from developers visiting malicious webpages. This could expose proprietary source code and configuration secrets.
Technical details
The vulnerability is an origin validation bypass in the WebSocket implementation of the development (hot module reloading) server included in @farmfe/core. The server accepts WebSocket connections without verifying the origin header, violating the same-origin policy. An attacker can craft a webpage that, when visited by a developer running the Farm dev server locally, establishes a WebSocket connection and receives unencrypted source code and project data. The attack requires user interaction (visiting a malicious webpage) and affects developers running local development servers. The vulnerability has been fixed in version 1.7.6.
Affected products
- Farm @farmfe/core before 1.7.6
Timeline
- 2026-02-12: disclosed
- 2026-02-12: patched: fixed in version 1.7.6