CVE-2022-24760: Command injection in Parse Server through prototype pollution
Summary
CVE-2022-24760: Command injection in Parse Server through prototype pollution. Affects parse-server versions < 4.10.7. Fixed in 4.10.7. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2022-24760 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that allows developers to build scalable and customizable applications. It provides a RESTful API for managing data and user authentication. Parse Server supports various databases, including MongoDB and Postgres. However, the default configuration with MongoDB is vulnerable to a command injection vulnerability through prototype pollution.
Vulnerability Detail
The command injection vulnerability in Parse Server arises from the insecure handling of user input in the DatabaseController.js file. This vulnerability allows an attacker to inject malicious commands into the application, leading to remote code execution. The vulnerability affects Parse Server in the default configuration with MongoDB, but it may also impact other database backends. The vulnerability has been confirmed on Linux (Ubuntu) and Windows. Exploiting this vulnerability can have severe consequences, including unauthorized access to sensitive data, modification or deletion of data, and potential compromise of the entire system.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.10.7
This is the first release that contains the fix.
npm install parse-server@4.10.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A targeted fix for the vulnerability can be applied by patching the MongoDB Node.js driver and disabling BSON code execution. The following code can be added to the index.js file before starting Parse Server:
const BSON = require('bson');
const internalDeserialize = BSON.prototype.deserialize;
BSON.prototype.deserialize = (buffer, options = Object.create(null), ...others) => {
if (options.constructor) {
options = Object.assign(Object.create(null), options);
}
return internalDeserialize(buffer, options, ...others);
};
const internalDeserializeStream = BSON.prototype.deserializeStream;
BSON.prototype.deserializeStream = (
data,
startIndex,
numberOfDocuments,
documents,
docStartIndex,
options = Object.create(null),
...others
) => {
if (options.constructor) {
options = Object.assign(Object.create(null), options);
}
return internalDeserializeStream(
data,
startIndex,
numberOfDocuments,
documents,
docStartIndex,
options,
...others
);
};
This workaround specifically addresses the vulnerability in the MongoDB Node.js driver and should be used until the Parse Server upgrade is applied.
Conclusion
The command injection vulnerability in Parse Server through prototype pollution is a critical issue that can lead to remote code execution and compromise of the entire system. It is crucial to upgrade to Parse Server version 4.10.7 or higher to mitigate this vulnerability. In the meantime, the provided workaround can be used to address the issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for parse-server →
FAQ
Parse Server is an open-source backend framework that allows developers to build scalable and customizable applications. It provides a RESTful API for managing data and user authentication.
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior or security issues. In the case of Parse Server, prototype pollution allows for command injection and potential remote code execution.
The vulnerability affects Parse Server versions prior to 4.10.7. If you are using a prerelease version of Parse Server 5.0, it may also be impacted.
Exploiting this vulnerability can result in remote code execution, allowing an attacker to execute arbitrary commands on the server. This can lead to unauthorized access, data manipulation, and compromise of the entire system.
Yes, a targeted fix can be applied by patching the MongoDB Node.js driver and disabling BSON code execution. The provided code snippet demonstrates how to implement this workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
