{"id":"CVE-2023-36475","aliases":["BIT-parse-2023-36475","EUVD-2023-1678","GHSA-462x-c3jw-7vr6"],"status":"published","title":"Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.03203,"percentile":0.88249,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2023-06-28T22:32:10Z","modified":"2026-10-28T02:31:07Z","fixes":[{"ecosystem":"npm","package":"parse-server","fixed_in":["5.5.2","6.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"parse","fixed_in":["5.5.2","6.2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"parse-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"parse-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.2.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"parse","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.5.2"},{"introduced":"6.0.0"},{"fixed":"6.2.1"}]}]},{"source":"osv","ecosystem":"npm","package":"parse-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.5.2"}]}]},{"source":"osv","ecosystem":"npm","package":"parse-server","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.2.1"}]}]}],"products":[{"vendor":"parse-community","product":"parse-server"},{"vendor":"parseplatform","product":"parse-server"}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/parse-community/parse-server/issues/8674","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","fix","report","web"]},{"url":"https://github.com/parse-community/parse-server/issues/8675","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","fix","report","web"]},{"url":"https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81f","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/parse-community/parse-server/releases/tag/5.5.2","tags":["x_refsource_MISC","x_transferred","Release Notes","article","web"]},{"url":"https://github.com/parse-community/parse-server/releases/tag/6.2.1","tags":["x_refsource_MISC","x_transferred","Release Notes","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36475","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-462x-c3jw-7vr6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36475.json","tags":["advisory"]},{"url":"https://github.com/parse-community/parse-server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-36475","title":"Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.","status":"published","published":"2023-06-28T22:32:10.081Z","modified":"2024-11-27T14:44:09.33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:35:28.218693Z"}],"euvd":[{"id":"EUVD-2023-1678","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.","status":"published","published":"2023-06-28T22:32:10Z","modified":"2024-11-27T14:44:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:46.096988Z"}],"ghsa":[{"id":"GHSA-462x-c3jw-7vr6","title":"Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution","description":"### Impact\n\nAn attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser.\n\n### Patches\n\nPrevent prototype pollution in MongoDB database adapter.\n\n### Workarounds\n\nDisable remote code execution through the MongoDB BSON parser.\n\n### Credits\n\n- Discovered by hir0ot working with Trend Micro Zero Day Initiative\n- Fixed by dbythy\n- Reviewed by mtrezza\n\n### References\n\n- https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6\n- https://github.com/advisories/GHSA-prm5-8g2m-24gg\n\n","status":"published","published":"2023-06-30T20:41:43Z","modified":"2023-11-06T05:03:14Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:37:14.234712Z"}],"nvd":[{"id":"CVE-2023-36475","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.","status":"published","published":"2023-06-28T23:15:21.14Z","modified":"2026-06-17T06:06:20.76Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:08:14.715708Z"}],"osv":[{"id":"CVE-2023-36475","title":"Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.","status":"published","published":"2023-06-28T22:32:10.081Z","modified":"2026-10-28T02:31:07.660080217Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"GHSA-462x-c3jw-7vr6","title":"Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution","description":"### Impact\n\nAn attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser.\n\n### Patches\n\nPrevent prototype pollution in MongoDB database adapter.\n\n### Workarounds\n\nDisable remote code execution through the MongoDB BSON parser.\n\n### Credits\n\n- Discovered by hir0ot working with Trend Micro Zero Day Initiative\n- Fixed by dbythy\n- Reviewed by mtrezza\n\n### References\n\n- https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6\n- https://github.com/advisories/GHSA-prm5-8g2m-24gg\n\n","status":"published","published":"2023-06-30T20:41:43Z","modified":"2026-09-10T03:50:01.804874589Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"BIT-parse-2023-36475","title":"Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.","status":"published","published":"2024-03-06T11:00:37.885Z","modified":"2026-09-08T08:48:24.48330796Z","updated_at":"2026-11-02T15:28:34.343258Z"}]}}