CVE-2021-47986
Fixed upstream EPSS <1%CVSS 7.5
Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in dependency declarations to execute unreviewed and potentially malicious code.
Products: parse-community parse-server
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | parse-server | 4.5.2 |
| npm | parse-server | 4.10.0 |