Remote code execution via MongoDB BSON parser through prototype pollution

CRITICAL 9.8CVE-2022-39396 · BIT-parse-2022-39396 · GHSA-prm5-8g2m-24gg · Published 10/11/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
parse-server parseplatform	`≥ 5.0.0, < 5.3.1< 4.10.18`	`5.3.14.10.18`
parse-server npm	`≥ 5.0.0, < 5.3.1< 4.10.18`	`5.3.14.10.18`

Description

Impact

An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser.

Patches

Prevent prototype pollution in MongoDB database adapter.

Workarounds

Disable remote code execution through the MongoDB BSON parser.

Collaborators

Mikhail Shcherbakov (KTH), Cristian-Alexandru Staicu (CISPA) and Musard Balliu (KTH) working with Trend Micro Zero Day Initiative

References

https://github.com/parse-community/parse-server/security/advisories/GHSA-prm5-8g2m-24gg

NVD description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.18, and prior to 5.3.1 on the 5.X branch, are vulnerable to Remote Code Execution via prototype pollution. An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. This issue is patched in version 5.3.1 and in 4.10.18. There are no known workarounds.

References

parse-community/parse-server security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-39396 · ADVISORY
parse-community/parse-server#8295 · WEB
parse-community/parse-server#8296 · WEB
parse-community/parse-server · PACKAGE
parse-community/parse-server release 4.10.18 · WEB
parse-community/parse-server release 5.3.1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

parse-server

parseplatform

≥ 5.0.0, < 5.3.1< 4.10.18

5.3.14.10.18

parse-server

npm

≥ 5.0.0, < 5.3.1< 4.10.18

5.3.14.10.18

Description

Impact

An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser.

Patches

Prevent prototype pollution in MongoDB database adapter.

Workarounds

Disable remote code execution through the MongoDB BSON parser.

Collaborators

Mikhail Shcherbakov (KTH), Cristian-Alexandru Staicu (CISPA) and Musard Balliu (KTH) working with Trend Micro Zero Day Initiative

References

https://github.com/parse-community/parse-server/security/advisories/GHSA-prm5-8g2m-24gg

NVD description