Most recent entries from all

BIT-parse-2023-36475 — Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution

2026-10-16T01:01:45.571896+00:00

Affected: Bitnami: parse

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.

EUVD-2026-204748

2026-10-16T01:01:45.571962+00:00

EUVD-2026-204748

fkie_cve-2023-36475

2026-10-16T01:01:45.571979+00:00

GHSA-462x-c3jw-7vr6 — Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution

2026-10-16T01:01:45.572003+00:00

Affected: npm: parse-server

### Impact

An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser.

### Patches

Prevent prototype pollution in MongoDB database adapter.

### Workarounds

Disable remote code execution through the MongoDB BSON parser.

### Credits

- Discovered by hir0ot working with Trend Micro Zero Day Initiative - Fixed by dbythy - Reviewed by mtrezza

### References

- https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6 - https://github.com/advisories/GHSA-prm5-8g2m-24gg

gsd-2023-36475

2026-10-16T01:01:45.572034+00:00

gsd-2023-36475