Threats tagged 'ghsa-5gp4-jgm9-v67j'

Parse Server versions before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 are affected by a prototype pollution vulnerability. This occurs because user-controlled keys are expanded into objects without checking for own properties. Attackers with class write access can send specially crafted keys using dot notation or ACL entry names that match built-in object members. This can corrupt built-in functions, causing all requests to the server to fail until it is restarted.