| Package | Affected versions | Patched versions |
|---|---|---|
| No affected product versions are listed for this vulnerability yet. | ||
Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building objects for Cloud Code triggers and LiveQuery, where a dot notation key whose intermediate segment resolves through an inherited member writes onto a process-wide built-in. Clients with write access to an object in a class with a trigger or LiveQuery can corrupt a built-in function, making unrelated requests fail until restart and denying service to all clients and hosted applications.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free