Missing Origin Validation in parcel-bundler
Summary
GHSA-5j4m-89xf-mf5p: Missing Origin Validation in parcel-bundler. Affects parcel-bundler versions < 1.10.0. Fixed in 1.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
parcel-bundler is an npm package used for bundling JavaScript, CSS, and other assets for web applications. It is commonly used in front-end development to optimize and package code for production. This package is vulnerable to a missing origin validation issue.
Vulnerability Detail
The missing origin validation vulnerability in parcel-bundler allows an attacker to bypass the same-origin policy and execute arbitrary code in the context of a vulnerable application. This can lead to various security risks, including cross-site scripting (XSS) attacks, data theft, and unauthorized access to sensitive information.
How To Fix
Latest published version: 1.12.5 as of 23 Oct 2026
npm install parcel-bundler@1.12.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.0
This is the first release that contains the fix.
npm install parcel-bundler@1.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of parcel-bundler to mitigate the risk.
Conclusion
The missing origin validation vulnerability in parcel-bundler can have serious security implications for web applications. It is crucial to update to the fixed version (1.10.0 or later) to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for parcel-bundler →
FAQ
parcel-bundler is an npm package used for bundling JavaScript, CSS, and other assets for web applications.
This vulnerability allows an attacker to bypass the same-origin policy and execute arbitrary code in the context of a vulnerable application, leading to potential security risks such as XSS attacks, data theft, and unauthorized access.
To fix this vulnerability, update parcel-bundler to version 1.10.0 or later by running the command 'npm install parcel-bundler@1.10.0' in your project directory.
There is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database: [link to the advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for parcel-bundler.
