CriticalFix available

Parse Server - Arbitrary Code Execution via Malicious Version Tags

Type: advisorySource: OSV1 source record

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it defined a git-based dependency referencing one of the affected tags (for example, parse-server#4.9.3). The code behind the tags was not reviewed or approved, and although no malicious code was identified, the introduction of security vulnerabilities could not be ruled out.

Announced 25 Sept 2026Group revision 1

Original source ↗

BIT-parse-2021-47987

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:BIT-parse-2021-47987

parse

Source reference: /affected/0/package/name

Affected versions: Not stated in this record
Fixed versions: 4.10.0
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.10.0"
          }
        ]
      }
    ],
    "package": {
      "name": "parse",
      "purl": "pkg:bitnami/parse",
      "ecosystem": "Bitnami"
    },
    "severity": [
      {
        "type": "CVSS_V4",
        "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
      }
    ],
    "database_specific": {
      "source": "https://github.com/bitnami/vulndb/tree/main/data/parse/BIT-parse-2021-47987.json"
    }
  }
]