What is GHSA-p773-8mf4-rjm5?

GHSA-p773-8mf4-rjm5 is a security advisory published by GitHub Security Advisories with Medium severity. @farmfe/core is Missing Origin Validation in WebSocket

Which CVE IDs does GHSA-p773-8mf4-rjm5 cover?

GHSA-p773-8mf4-rjm5 covers the following CVE IDs: CVE-2025-56647. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p773-8mf4-rjm5?

GHSA-p773-8mf4-rjm5 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-p773-8mf4-rjm5?

GHSA-p773-8mf4-rjm5 affects 1 product, including: npm/@farmfe/core:\u003c 1.7.6.

GHSA-p773-8mf4-rjm5MediumCVSS 6.5

@farmfe/core is Missing Origin Validation in WebSocket

Vendor

GitHub Security Advisories

Published

February 12, 2026

Last Modified

February 12, 2026

🔗 CVE IDs covered (1)

CVE-2025-56647 →

📋 Description

npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leaked by the WebSocket server.

🎯 Affected products1

npm/@farmfe/core:< 1.7.6

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-56647
https://github.com/farm-fe/farm/issues/2168
https://github.com/farm-fe/farm/commit/83342ef06e0aea37270950fd8c930422c4df0679
https://gist.github.com/R4356th/d4372c6f83275d583c180c0e7d7332af
https://github.com/advisories/GHSA-p773-8mf4-rjm5