CVE-2018-14731
CVSS v3
7.5
HIGH
EPSS Score
2.3 %
exploit probability, as of 2026-09-25
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1 connection (with a random TCP port number) from any origin. The random port number can be found by connecting to http://127.0.0.1 and reading the "new WebSocket" line in the source code.
Technical details
- Published
- 2018-09-21
Frequently asked questions
What is CVE-2018-14731?
An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1 connection (with a random TCP port number) from any origin. The random port number can be found by connecting to http://127.0.0.1 and reading the "new WebSocket" line in the source code.
Is CVE-2018-14731 actively exploited?
Active exploitation of CVE-2018-14731 has not been confirmed. Its EPSS score was 2.3% on 2026-09-25, the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2018-14731?
CVE-2018-14731 has a CVSS v3 base score of 7.5 (HIGH severity).
Is CVE-2018-14731 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2018 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).