What is GHSA-77q4-m83q-w76v?

GHSA-77q4-m83q-w76v is a security advisory published by GitHub Security Advisories with High severity. Missing Origin Validation in browserify-hmr

Which CVE IDs does GHSA-77q4-m83q-w76v cover?

GHSA-77q4-m83q-w76v covers the following CVE IDs: CVE-2018-14730. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-77q4-m83q-w76v?

GHSA-77q4-m83q-w76v has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-77q4-m83q-w76v?

GHSA-77q4-m83q-w76v affects 1 product, including: npm/browserify-hmr:\u003c 0.4.0.

GHSA-77q4-m83q-w76vHighCVSS 7.5

Missing Origin Validation in browserify-hmr

Vendor

GitHub Security Advisories

Published

September 1, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2018-14730 →

📋 Description

Versions of browserify-hmr prior to 0.4.0 are missing origin validation on the websocket server.

This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.

Recommendation

Upgrade to version 0.4.0 or later.

🎯 Affected products1

npm/browserify-hmr:< 0.4.0

🔗 References (6)

https://github.com/AgentME/browserify-hmr/issues/41
https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages)
https://www.npmjs.com/advisories/726
https://nvd.nist.gov/vuln/detail/CVE-2018-14730
https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages
https://github.com/advisories/GHSA-77q4-m83q-w76v