Threats tagged 'ghsa-jqwm-2hj5-gmq3'

Parse Server versions before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 improperly handle dot notation keys with null or undefined values during object saving. This causes writes to be stored but return errors, skipping afterSave triggers and LiveQuery events. An attacker with write access can exploit this behavior to bypass audit logging, notifications, and updates to derived data.