Parse Server - Unreviewed Code Execution via Malicious Version Tags
Priority LOW 35CWE-494Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-494.
Summary
Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in dependency declarations to execute unreviewed and potentially malicious code.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0018 7th percentileScored 2026-11-07
Fix Fixed parse-server (parse-community): 4.10.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| parse-community | parse-server | before 4.10.0 | 4.10.0 | Patch available | CNA |
- parse-server Vendorparse-community Affected before 4.10.0 Fixed in 4.10.0 Patch available CNA
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:parseplatform:parse-server:4.0.0:beta1:*:*:*:node.js:*:* | 4.0.0 beta1 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.0.0:beta2:*:*:*:node.js:*:* | 4.0.0 beta2 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.0.0:beta3:*:*:*:node.js:*:* | 4.0.0 beta3 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.0.0:beta4:*:*:*:node.js:*:* | 4.0.0 beta4 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.0.0:beta5:*:*:*:node.js:*:* | 4.0.0 beta5 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.0.0:beta6:*:*:*:node.js:*:* | 4.0.0 beta6 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.0.3:*:*:*:*:node.js:*:* | 4.0.3 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.0.4:*:*:*:*:node.js:*:* | 4.0.4 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.0.6:*:*:*:*:node.js:*:* | 4.0.6 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.0.7:*:*:*:*:node.js:*:* | 4.0.7 | Vulnerable | parse-community |
- cpe:2.3:a:parseplatform:parse-server:4.0.0:beta1:*:*:*:node.js:*:* Versions 4.0.0 beta1 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.0.0:beta2:*:*:*:node.js:*:* Versions 4.0.0 beta2 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.0.0:beta3:*:*:*:node.js:*:* Versions 4.0.0 beta3 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.0.0:beta4:*:*:*:node.js:*:* Versions 4.0.0 beta4 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.0.0:beta5:*:*:*:node.js:*:* Versions 4.0.0 beta5 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.0.0:beta6:*:*:*:node.js:*:* Versions 4.0.0 beta6 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.0.3:*:*:*:*:node.js:*:* Versions 4.0.3 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.0.4:*:*:*:*:node.js:*:* Versions 4.0.4 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.0.6:*:*:*:*:node.js:*:* Versions 4.0.6 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.0.7:*:*:*:*:node.js:*:* Versions 4.0.7 Vulnerable ·parse-community
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:parseplatform:parse-server:4.0.8:*:*:*:*:node.js:*:* | 4.0.8 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.0.9:*:*:*:*:node.js:*:* | 4.0.9 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.0.10:*:*:*:*:node.js:*:* | 4.0.10 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.0.11:*:*:*:*:node.js:*:* | 4.0.11 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.0.12:*:*:*:*:node.js:*:* | 4.0.12 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.0.13:*:*:*:*:node.js:*:* | 4.0.13 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.0.14:*:*:*:*:node.js:*:* | 4.0.14 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.6.0:-:*:*:*:node.js:*:* | 4.6.0 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.6.0:beta:*:*:*:node.js:*:* | 4.6.0 beta | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.7.0:*:*:*:*:node.js:*:* | 4.7.0 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.8.0:*:*:*:*:node.js:*:* | 4.8.0 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.8.1:*:*:*:*:node.js:*:* | 4.8.1 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.8.2:*:*:*:*:node.js:*:* | 4.8.2 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.8.3:*:*:*:*:node.js:*:* | 4.8.3 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.8.4:*:*:*:*:node.js:*:* | 4.8.4 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.8.5:*:*:*:*:node.js:*:* | 4.8.5 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.9.0:*:*:*:*:node.js:*:* | 4.9.0 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.9.1:*:*:*:*:node.js:*:* | 4.9.1 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.9.2:*:*:*:*:node.js:*:* | 4.9.2 | Vulnerable | parse-community |
| cpe:2.3:a:parseplatform:parse-server:4.9.3:*:*:*:*:node.js:*:* | 4.9.3 | Vulnerable | parse-community |
- cpe:2.3:a:parseplatform:parse-server:4.0.8:*:*:*:*:node.js:*:* Versions 4.0.8 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.0.9:*:*:*:*:node.js:*:* Versions 4.0.9 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.0.10:*:*:*:*:node.js:*:* Versions 4.0.10 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.0.11:*:*:*:*:node.js:*:* Versions 4.0.11 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.0.12:*:*:*:*:node.js:*:* Versions 4.0.12 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.0.13:*:*:*:*:node.js:*:* Versions 4.0.13 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.0.14:*:*:*:*:node.js:*:* Versions 4.0.14 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.6.0:-:*:*:*:node.js:*:* Versions 4.6.0 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.6.0:beta:*:*:*:node.js:*:* Versions 4.6.0 beta Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.7.0:*:*:*:*:node.js:*:* Versions 4.7.0 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.8.0:*:*:*:*:node.js:*:* Versions 4.8.0 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.8.1:*:*:*:*:node.js:*:* Versions 4.8.1 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.8.2:*:*:*:*:node.js:*:* Versions 4.8.2 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.8.3:*:*:*:*:node.js:*:* Versions 4.8.3 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.8.4:*:*:*:*:node.js:*:* Versions 4.8.4 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.8.5:*:*:*:*:node.js:*:* Versions 4.8.5 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.9.0:*:*:*:*:node.js:*:* Versions 4.9.0 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.9.1:*:*:*:*:node.js:*:* Versions 4.9.1 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.9.2:*:*:*:*:node.js:*:* Versions 4.9.2 Vulnerable ·parse-community
- cpe:2.3:a:parseplatform:parse-server:4.9.3:*:*:*:*:node.js:*:* Versions 4.9.3 Vulnerable ·parse-community
Remediation
- Fix · CNA parse-server (parse-community) Fixed in 4.10.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
parse-community parse-server — GitHub Security Advisory (GHSA-593v-wcqx-hq2w)
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-22600 Parse Server - Arbitrary Code Execution via Malicious Version TagsPriority LOW 35
Timeline
- 2026-10-02 Threatist record created from CVE-2021-47986
- 2026-10-03 Alias added: GHSA-g938-h978-wf7v
References
More parse-community Parse-server vulnerabilities
- TI-2022-08574 Command Injection in Parse server CVSS 3.1CRITICAL 10.0
- TI-2024-18136 Parse Server literalizeRegexPart SQL Injection CVSS 3.1CRITICAL 10.0
- TI-2022-18768 Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser CVSS 3.1CRITICAL 9.8
- TI-2024-31550 Parse Server's custom object ID allows to acquire role privileges CVSS 3.1HIGH 8.1
- TI-2023-18316 Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution CVSS 3.1CRITICAL 9.8
- TI-2026-23790 Parse Server session token exfiltration via `redirectClassNameForKey` query parameter CVSS 4.0CRITICAL 9.9
Sources
- CVE-2021-47986 · CVE Program
- CVE-2021-47986 · NVD
- FIRST EPSS
- GHSA-g938-h978-wf7v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences