Back to Database
Status published
Critical
CVE-2023-36475
Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
Vulnerability Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-36475
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6
- https://github.com/parse-community/parse-server/issues/8674
- https://github.com/parse-community/parse-server/issues/8675
- https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90
- https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81f
- https://github.com/parse-community/parse-server/releases/tag/5.5.2
- https://github.com/parse-community/parse-server/releases/tag/6.2.1
More from parse-community
View All →CVE-2025-68150
Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter
High
8.3
CVE-2025-68115
Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables
Medium
5.3
CVE-2025-67727
Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management
Medium
6.9
CVE-2025-64502
Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details
Medium
6.9
CVE-2025-64430
Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format
High
7.5
Affected Vendor
parse-community
View all reports →Affected Software
parse-server
Vulnerable Versions:
< 5.5.2, >= 6.0.0, < 6.2.1
Timeline
Official Publish:
June 28th, 2023
Last Modified:
November 27th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.