parse-server (npm)
Advisories
225
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 9.10.0-alpha.2 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install parse-server@9.10.0-alpha.2yarn
yarn add parse-server@9.10.0-alpha.2pnpm
pnpm add parse-server@9.10.0-alpha.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-r899-h629-j84r Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist |
Low EPSS 0.41% |
>= 9.0.0, < 9.10.0-alpha.2 | 9.10.0-alpha.2 |
| GHSA-r899-h629-j84r Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist |
Low EPSS 0.41% |
<= 8.6.83 | No fix yet |
| GHSA-r899-h629-j84r Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist |
Low EPSS 0.41% |
>= 9.0.0, < 9.10.0-alpha.2 | 9.10.0-alpha.2 |
| GHSA-r899-h629-j84r Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist |
Low EPSS 0.41% |
< 8.6.84 | 8.6.84 |
| GHSA-p6c5-mjgj-m4rm Duplicate Advisory: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist Withdrawn |
Low | <= 8.6.83 | No fix yet |
| GHSA-p6c5-mjgj-m4rm Duplicate Advisory: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist Withdrawn |
Low | <= 8.6.83 | No fix yet |
| GHSA-p6c5-mjgj-m4rm Duplicate Advisory: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist Withdrawn |
Low | >= 9.0.0, < 9.10.0-alpha.2 | 9.10.0-alpha.2 |
| GHSA-p6c5-mjgj-m4rm Duplicate Advisory: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist Withdrawn |
Low | >= 9.0.0 | No fix yet |
| GHSA-97pr-9hgg-3p8r parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change |
Low EPSS 0.53% |
>= 9.0.0, < 9.9.1-alpha.13 | 9.9.1-alpha.13 |
| GHSA-97pr-9hgg-3p8r parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change |
Low EPSS 0.53% |
< 8.6.83 | 8.6.83 |
| GHSA-v8x7-r927-cc93 parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist |
Low EPSS 0.55% |
< 8.6.81 | 8.6.81 |
| GHSA-v8x7-r927-cc93 parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist |
Low EPSS 0.55% |
>= 9.0.0, < 9.9.1-alpha.11 | 9.9.1-alpha.11 |
| GHSA-cgxm-vr2f-6fj8 parse-server: Denial of service via exponential-time processing of deeply nested query operators |
High EPSS 0.59% |
< 8.6.82 | 8.6.82 |
| GHSA-cgxm-vr2f-6fj8 parse-server: Denial of service via exponential-time processing of deeply nested query operators |
High EPSS 0.59% |
>= 9.0.0, < 9.9.1-alpha.12 | 9.9.1-alpha.12 |
| GHSA-wmwx-jr2p-4j4r parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL |
Medium EPSS 0.28% |
>= 9.0.0, < 9.9.1-alpha.6 | 9.9.1-alpha.6 |
| GHSA-wmwx-jr2p-4j4r parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL |
Medium EPSS 0.28% |
< 8.6.80 | 8.6.80 |
| GHSA-75v4-m273-5j49 parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied |
Medium EPSS 0.25% |
>= 9.8.0, < 9.9.1-alpha.5 | 9.9.1-alpha.5 |
| GHSA-7wqv-xjf3-x35v parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist |
Low EPSS 0.28% |
< 8.6.79 | 8.6.79 |
| GHSA-7wqv-xjf3-x35v parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist |
Low EPSS 0.28% |
>= 9.0.0, < 9.9.1-alpha.4 | 9.9.1-alpha.4 |
| GHSA-p84r-h6rx-f2xr parse-server: Server option routeAllowList is bypassable through batch sub-requests |
Medium EPSS 0.34% |
>= 9.8.0, < 9.9.1-alpha.3 | 9.9.1-alpha.3 |
| GHSA-8cph-rgr4-g5vj Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers |
Medium EPSS 0.29% |
< 8.6.78 | 8.6.78 |
| GHSA-8cph-rgr4-g5vj Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers |
Medium EPSS 0.29% |
>= 9.0.0, < 9.9.1-alpha.2 | 9.9.1-alpha.2 |
| GHSA-38m6-82c8-4xfm Parse Server: Pre-authentication denial of service via client version header regex backtracking |
High EPSS 0.58% |
>= 9.0.0, < 9.9.1-alpha.1 | 9.9.1-alpha.1 |
| GHSA-38m6-82c8-4xfm Parse Server: Pre-authentication denial of service via client version header regex backtracking |
High EPSS 0.58% |
< 8.6.77 | 8.6.77 |
| GHSA-jpq4-7fmq-q5fj parse-server: MFA SMS one-time password accepted twice under concurrent login |
Medium EPSS 0.24% |
>= 9.0.0, < 9.9.0-alpha.2 | 9.9.0-alpha.2 |
| GHSA-jpq4-7fmq-q5fj parse-server: MFA SMS one-time password accepted twice under concurrent login |
Medium EPSS 0.24% |
< 8.6.76 | 8.6.76 |
| GHSA-g4v2-qx3q-4p64 Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` |
Medium EPSS 0.19% |
>= 7.0.0, < 8.6.75 | 8.6.75 |
| GHSA-g4v2-qx3q-4p64 Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` |
Medium EPSS 0.19% |
>= 9.0.0, < 9.8.0-alpha.7 | 9.8.0-alpha.7 |
| GHSA-mmpq-5hcv-hf2v Parse Server has a login timing side-channel reveals user existence |
Low EPSS 0.23% |
< 8.6.74 | 8.6.74 |
| GHSA-mmpq-5hcv-hf2v Parse Server has a login timing side-channel reveals user existence |
Low EPSS 0.23% |
>= 9.0.0, < 9.8.0-alpha.6 | 9.8.0-alpha.6 |
| GHSA-vr5f-2r24-w5hc Parse Server: File upload Content-Type override via extension mismatch |
Medium EPSS 0.16% |
>= 9.0.0, < 9.7.1-alpha.4 | 9.7.1-alpha.4 |
| GHSA-vr5f-2r24-w5hc Parse Server: File upload Content-Type override via extension mismatch |
Medium EPSS 0.16% |
< 8.6.73 | 8.6.73 |
| GHSA-hpm8-9qx6-jvwv Parser Server's streaming file download bypasses afterFind file trigger authorization |
High EPSS 0.39% |
< 8.6.71 | 8.6.71 |
| GHSA-hpm8-9qx6-jvwv Parser Server's streaming file download bypasses afterFind file trigger authorization |
High EPSS 0.39% |
>= 9.0.0, < 9.7.1-alpha.1 | 9.7.1-alpha.1 |
| GHSA-mmg8-87c5-jrc2 Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value |
Medium EPSS 0.26% |
>= 9.0.0, < 9.7.0-alpha.16 | 9.7.0-alpha.16 |
| GHSA-mmg8-87c5-jrc2 Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value |
Medium EPSS 0.26% |
< 8.6.70 | 8.6.70 |
| GHSA-f6j3-w9v3-cq22 Parse Server has a session field immutability bypass via falsy-value guard |
Medium EPSS 0.22% |
>= 9.0.0, < 9.7.0-alpha.14 | 9.7.0-alpha.14 |
| GHSA-f6j3-w9v3-cq22 Parse Server has a session field immutability bypass via falsy-value guard |
Medium EPSS 0.22% |
< 8.6.69 | 8.6.69 |
| GHSA-mfj6-6p54-m98c parse-server has GraphQL complexity validator exponential fragment traversal DoS |
High EPSS 0.64% |
>= 9.0.0, < 9.7.0-alpha.12 | 9.7.0-alpha.12 |
| GHSA-mfj6-6p54-m98c parse-server has GraphQL complexity validator exponential fragment traversal DoS |
High EPSS 0.64% |
< 8.6.68 | 8.6.68 |
| GHSA-vpj2-qq7w-5qq6 parse-server has cloud function validator bypass via prototype chain traversal |
Critical EPSS 0.28% |
>= 9.0.0, < 9.7.0-alpha.11 | 9.7.0-alpha.11 |
| GHSA-vpj2-qq7w-5qq6 parse-server has cloud function validator bypass via prototype chain traversal |
Critical EPSS 0.28% |
< 8.6.67 | 8.6.67 |
| GHSA-q3p6-g7c4-829c GraphQL API endpoint ignores CORS origin restriction |
High EPSS 0.21% |
>= 9.0.0, < 9.7.0-alpha.10 | 9.7.0-alpha.10 |
| GHSA-q3p6-g7c4-829c GraphQL API endpoint ignores CORS origin restriction |
High EPSS 0.21% |
>= 3.5.0, < 8.6.66 | 8.6.66 |
| GHSA-m983-v2ff-wq65 LiveQuery protected field leak via shared mutable state across concurrent subscribers |
Medium EPSS 0.37% |
< 8.6.65 | 8.6.65 |
| GHSA-m983-v2ff-wq65 LiveQuery protected field leak via shared mutable state across concurrent subscribers |
Medium EPSS 0.37% |
>= 9.0.0, < 9.7.0-alpha.9 | 9.7.0-alpha.9 |
| GHSA-w73w-g5xw-rwhf Parse Server has an MFA single-use token bypass via concurrent authData login requests |
Medium EPSS 0.32% |
>= 9.0.0, < 9.7.0-alpha.8 | 9.7.0-alpha.8 |
| GHSA-w73w-g5xw-rwhf Parse Server has an MFA single-use token bypass via concurrent authData login requests |
Medium EPSS 0.32% |
< 8.6.64 | 8.6.64 |
| GHSA-wp76-gg32-8258 Parse Server exposes auth data via verify password endpoint |
Medium EPSS 0.31% |
>= 9.0.0, < 9.7.0-alpha.7 | 9.7.0-alpha.7 |
| GHSA-wp76-gg32-8258 Parse Server exposes auth data via verify password endpoint |
Medium EPSS 0.31% |
< 8.6.63 | 8.6.63 |
| GHSA-37mj-c2wf-cx96 Parse Server exposes auth data via /users/me endpoint |
Medium EPSS 0.39% |
< 8.6.61 | 8.6.61 |
| GHSA-37mj-c2wf-cx96 Parse Server exposes auth data via /users/me endpoint |
Medium EPSS 0.39% |
>= 9.0.0, < 9.6.0-alpha.55 | 9.6.0-alpha.55 |
| GHSA-2299-ghjr-6vjp Parse Server: MFA recovery code single-use bypass via concurrent requests |
Low EPSS 0.18% |
< 8.6.60 | 8.6.60 |
| GHSA-2299-ghjr-6vjp Parse Server: MFA recovery code single-use bypass via concurrent requests |
Low EPSS 0.18% |
>= 9.0.0, < 9.6.0-alpha.54 | 9.6.0-alpha.54 |
| GHSA-p2w6-rmh7-w8q3 Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter |
High EPSS 0.47% |
>= 9.0.0, < 9.6.0-alpha.53 | 9.6.0-alpha.53 |
| GHSA-p2w6-rmh7-w8q3 Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter |
High EPSS 0.47% |
< 8.6.59 | 8.6.59 |
| GHSA-g4cf-xj29-wqqr Parse Server: Denial of Service via unindexed database query for unconfigured auth providers |
High EPSS 0.42% |
< 8.6.58 | 8.6.58 |
| GHSA-g4cf-xj29-wqqr Parse Server: Denial of Service via unindexed database query for unconfigured auth providers |
High EPSS 0.42% |
>= 9.0.0, < 9.6.0-alpha.52 | 9.6.0-alpha.52 |
| GHSA-jc39-686j-wp6q Parse Server's Session Update endpoint allows overwriting server-generated session fields |
Medium EPSS 0.27% |
< 8.6.57 | 8.6.57 |
| GHSA-jc39-686j-wp6q Parse Server's Session Update endpoint allows overwriting server-generated session fields |
Medium EPSS 0.27% |
>= 9.0.0, < 9.6.0-alpha.48 | 9.6.0-alpha.48 |
| GHSA-6qh5-m6g3-xhq6 Parse Server LiveQuery subscription query depth bypass |
High EPSS 0.35% |
< 8.6.56 | 8.6.56 |
| GHSA-6qh5-m6g3-xhq6 Parse Server LiveQuery subscription query depth bypass |
High EPSS 0.35% |
>= 9.0.0, < 9.6.0-alpha.45 | 9.6.0-alpha.45 |
| GHSA-9fjp-q3c4-6w3j Parse Server has a query condition depth bypass via pre-validation transform pipeline |
High EPSS 0.47% |
< 8.6.55 | 8.6.55 |
| GHSA-9fjp-q3c4-6w3j Parse Server has a query condition depth bypass via pre-validation transform pipeline |
High EPSS 0.47% |
>= 9.0.0, < 9.6.0-alpha.44 | 9.6.0-alpha.44 |
| GHSA-qpc3-fg4j-8hgm Parse Server has a protected field change detection oracle via LiveQuery watch parameter |
Medium EPSS 0.33% |
>= 9.0.0, < 9.6.0-alpha.43 | 9.6.0-alpha.43 |
| GHSA-qpc3-fg4j-8hgm Parse Server has a protected field change detection oracle via LiveQuery watch parameter |
Medium EPSS 0.33% |
< 8.6.54 | 8.6.54 |
| GHSA-fph2-r4qg-9576 Parse Server's LiveQuery bypasses CLP pointer permission enforcement |
Medium EPSS 0.41% |
>= 9.0.0, < 9.6.0-alpha.42 | 9.6.0-alpha.42 |
| GHSA-fph2-r4qg-9576 Parse Server's LiveQuery bypasses CLP pointer permission enforcement |
Medium EPSS 0.41% |
< 8.6.53 | 8.6.53 |
| GHSA-pfj7-wv7c-22pr Parse Server has an auth provider validation bypass on login via partial authData |
Critical EPSS 0.47% |
< 8.6.52 | 8.6.52 |
| GHSA-pfj7-wv7c-22pr Parse Server has an auth provider validation bypass on login via partial authData |
Critical EPSS 0.47% |
>= 9.0.0, < 9.6.0-alpha.41 | 9.6.0-alpha.41 |
| GHSA-h29g-q5c2-9h4f Parse Server email verification resend page leaks user existence |
Medium EPSS 0.34% |
>= 9.0.0, < 9.6.0-alpha.40 | 9.6.0-alpha.40 |
| GHSA-h29g-q5c2-9h4f Parse Server email verification resend page leaks user existence |
Medium EPSS 0.34% |
< 8.6.51 | 8.6.51 |
| GHSA-5hmj-jcgp-6hff Parse Server leaks protected fields via LiveQuery afterEvent trigger |
Medium EPSS 0.44% |
< 8.6.50 | 8.6.50 |
| GHSA-5hmj-jcgp-6hff Parse Server leaks protected fields via LiveQuery afterEvent trigger |
Medium EPSS 0.44% |
>= 9.0.0, < 9.6.0-alpha.35 | 9.6.0-alpha.35 |
| GHSA-wjqw-r9x4-j59v Parse Server affected by empty authData bypassing credential requirement on signup |
Medium EPSS 0.31% |
< 8.6.49 | 8.6.49 |
| GHSA-wjqw-r9x4-j59v Parse Server affected by empty authData bypassing credential requirement on signup |
Medium EPSS 0.31% |
>= 9.0.0, < 9.6.0-alpha.29 | 9.6.0-alpha.29 |
| GHSA-827p-g5x5-h86c Parse Server LiveQuery subscription with invalid regular expression crashes server |
High EPSS 0.57% |
>= 9.0.0, < 9.6.0-alpha.19 | 9.6.0-alpha.19 |
| GHSA-827p-g5x5-h86c Parse Server LiveQuery subscription with invalid regular expression crashes server |
High EPSS 0.57% |
< 8.6.43 | 8.6.43 |
| GHSA-5v7g-9h8f-8pgg Parse Server session creation endpoint allows overwriting server-generated session fields |
Medium EPSS 0.32% |
>= 9.0.0, < 9.6.0-alpha.17 | 9.6.0-alpha.17 |
| GHSA-5v7g-9h8f-8pgg Parse Server session creation endpoint allows overwriting server-generated session fields |
Medium EPSS 0.32% |
< 8.6.42 | 8.6.42 |
| GHSA-9ccr-fpp6-78qf Parse Server vulnerable to schema poisoning via prototype pollution in deep copy |
High EPSS 0.36% |
< 8.6.44 | 8.6.44 |
| GHSA-9ccr-fpp6-78qf Parse Server vulnerable to schema poisoning via prototype pollution in deep copy |
High EPSS 0.36% |
>= 9.0.0, < 9.6.0-alpha.20 | 9.6.0-alpha.20 |
| GHSA-4263-jgmp-7pf4 Parse Server's Cloud function dispatch crashes server via prototype chain traversal |
High EPSS 0.53% |
< 8.6.47 | 8.6.47 |
| GHSA-4263-jgmp-7pf4 Parse Server's Cloud function dispatch crashes server via prototype chain traversal |
High EPSS 0.53% |
>= 9.0.0, < 9.6.0-alpha.24 | 9.6.0-alpha.24 |
| GHSA-r3xq-68wh-gwvh Parse Server has a password reset token single-use bypass via concurrent requests |
Low EPSS 0.21% |
< 8.6.48 | 8.6.48 |
| GHSA-r3xq-68wh-gwvh Parse Server has a password reset token single-use bypass via concurrent requests |
Low EPSS 0.21% |
>= 9.0.0, < 9.6.0-alpha.28 | 9.6.0-alpha.28 |
| GHSA-9xp9-j92r-p88v Parse Server crash via deeply nested query condition operators |
High EPSS 0.50% |
< 8.6.45 | 8.6.45 |
| GHSA-9xp9-j92r-p88v Parse Server crash via deeply nested query condition operators |
High EPSS 0.50% |
>= 9.0.0, < 9.6.0-alpha.21 | 9.6.0-alpha.21 |
| GHSA-42ph-pf9q-cr72 Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries |
High EPSS 0.28% |
< 8.6.41 | 8.6.41 |
| GHSA-42ph-pf9q-cr72 Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries |
High EPSS 0.28% |
>= 9.0.0, < 9.6.0-alpha.15 | 9.6.0-alpha.15 |
| GHSA-p2x3-8689-cwpg Parse Server's GraphQL WebSocket endpoint bypasses security middleware |
High EPSS 0.36% |
< 8.6.40 | 8.6.40 |
| GHSA-p2x3-8689-cwpg Parse Server's GraphQL WebSocket endpoint bypasses security middleware |
High EPSS 0.36% |
>= 9.0.0, < 9.6.0-alpha.14 | 9.6.0-alpha.14 |
| GHSA-69xg-f649-w5g2 Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint |
Medium EPSS 0.29% |
>= 8.0.2, < 8.6.39 | 8.6.39 |
| GHSA-69xg-f649-w5g2 Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint |
Medium EPSS 0.29% |
>= 9.0.0, < 9.6.0-alpha.13 | 9.6.0-alpha.13 |
| GHSA-5fw2-8jcv-xh87 Parse Server: Account takeover via operator injection in authentication data identifier |
Critical EPSS 0.64% |
>= 9.0.0, < 9.6.0-alpha.12 | 9.6.0-alpha.12 |
| GHSA-5fw2-8jcv-xh87 Parse Server: Account takeover via operator injection in authentication data identifier |
Critical EPSS 0.64% |
< 8.6.38 | 8.6.38 |
| GHSA-2cjm-2gwv-m892 Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance |
High EPSS 0.27% |
>= 9.0.0, < 9.6.0-alpha.11 | 9.6.0-alpha.11 |
| GHSA-2cjm-2gwv-m892 Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance |
High EPSS 0.27% |
< 8.6.37 | 8.6.37 |
| GHSA-c442-97qw-j6c6 Parse Server has a SQL injection via query field name when using PostgreSQL |
Medium EPSS 0.21% |
< 8.6.36 | 8.6.36 |
| GHSA-c442-97qw-j6c6 Parse Server has a SQL injection via query field name when using PostgreSQL |
Medium EPSS 0.21% |
>= 9.0.0, < 9.6.0-alpha.10 | 9.6.0-alpha.10 |
| GHSA-j7mm-f4rv-6q6q Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause |
High EPSS 0.30% |
>= 9.0.0, < 9.6.0-alpha.9 | 9.6.0-alpha.9 |
| GHSA-j7mm-f4rv-6q6q Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause |
High EPSS 0.30% |
< 8.6.35 | 8.6.35 |
| GHSA-w54v-hf9p-8856 Parse Server vulnerable to user enumeration via email verification endpoint |
Medium EPSS 0.25% |
< 8.6.34 | 8.6.34 |
| GHSA-w54v-hf9p-8856 Parse Server vulnerable to user enumeration via email verification endpoint |
Medium EPSS 0.25% |
>= 9.0.0-alpha.1, < 9.6.0-alpha.8 | 9.6.0-alpha.8 |
| GHSA-4hf6-3x24-c9m8 Parse Server's MFA recovery codes not consumed after use |
Medium EPSS 0.49% |
>= 9.0.0-alpha.1, < 9.6.0-alpha.7 | 9.6.0-alpha.7 |
| GHSA-4hf6-3x24-c9m8 Parse Server's MFA recovery codes not consumed after use |
Medium EPSS 0.49% |
< 8.6.33 | 8.6.33 |
| GHSA-r2m8-pxm9-9c4g Parse Server has a protected fields bypass via dot-notation in query and sort |
High EPSS 0.38% |
>= 9.0.0-alpha.1, < 9.6.0-alpha.6 | 9.6.0-alpha.6 |
| GHSA-r2m8-pxm9-9c4g Parse Server has a protected fields bypass via dot-notation in query and sort |
High EPSS 0.38% |
< 8.6.32 | 8.6.32 |
| GHSA-gqpp-xgvh-9h7h Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL |
Critical EPSS 0.43% |
< 8.6.31 | 8.6.31 |
| GHSA-gqpp-xgvh-9h7h Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL |
Critical EPSS 0.43% |
>= 9.0.0-alpha.1, < 9.6.0-alpha.5 | 9.6.0-alpha.5 |
| GHSA-v5hf-f4c3-m5rv Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types |
Medium EPSS 0.26% |
>= 9.0.0-alpha.1, < 9.6.0-alpha.4 | 9.6.0-alpha.4 |
| GHSA-v5hf-f4c3-m5rv Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types |
Medium EPSS 0.26% |
< 8.6.30 | 8.6.30 |
| GHSA-q3vj-96h2-gwvg Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL |
Critical EPSS 0.44% |
< 8.6.29 | 8.6.29 |
| GHSA-q3vj-96h2-gwvg Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL |
Critical EPSS 0.44% |
>= 9.0.0-alpha.1, < 9.6.0-alpha.3 | 9.6.0-alpha.3 |
| GHSA-7m6r-fhh7-r47c Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction |
High EPSS 0.45% |
>= 9.0.0-alpha.1, < 9.5.2-alpha.13 | 9.5.2-alpha.13 |
| GHSA-7m6r-fhh7-r47c Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction |
High EPSS 0.45% |
< 8.6.26 | 8.6.26 |
| GHSA-7xg7-rqf6-pw6c Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes |
Critical EPSS 0.35% |
>= 9.0.0-alpha.1, < 9.5.2-alpha.12 | 9.5.2-alpha.12 |
| GHSA-7xg7-rqf6-pw6c Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes |
Critical EPSS 0.35% |
< 8.6.25 | 8.6.25 |
| GHSA-775h-3xrc-c228 Parse Server has a rate limit bypass via batch request endpoint |
High EPSS 0.36% |
>= 9.0.0-alpha.1, < 9.5.2-alpha.10 | 9.5.2-alpha.10 |
| GHSA-775h-3xrc-c228 Parse Server has a rate limit bypass via batch request endpoint |
High EPSS 0.36% |
< 8.6.23 | 8.6.23 |
| GHSA-fr88-w35c-r596 Parse Server OAuth2 authentication adapter account takeover via identity spoofing |
High EPSS 0.35% |
< 8.6.22 | 8.6.22 |
| GHSA-fr88-w35c-r596 Parse Server OAuth2 authentication adapter account takeover via identity spoofing |
High EPSS 0.35% |
>= 9.0.0-alpha.1, < 9.5.2-alpha.9 | 9.5.2-alpha.9 |
| GHSA-5f92-jrq3-28rc Parse Server has role escalation and CLP bypass via direct `_Join` table write |
Critical EPSS 0.40% |
< 8.6.20 | 8.6.20 |
| GHSA-5f92-jrq3-28rc Parse Server has role escalation and CLP bypass via direct `_Join` table write |
Critical EPSS 0.40% |
>= 9.0.0-alpha.1, < 9.5.2-alpha.7 | 9.5.2-alpha.7 |
| GHSA-6r2j-cxgf-495f Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter |
Critical EPSS 1.36% |
< 8.6.21 | 8.6.21 |
| GHSA-6r2j-cxgf-495f Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter |
Critical EPSS 1.36% |
>= 9.0.0-alpha.1, < 9.5.2-alpha.8 | 9.5.2-alpha.8 |
| GHSA-72hp-qff8-4pvv Parse Server has a protected fields bypass via logical query operators |
Medium EPSS 0.32% |
>= 9.0.0, < 9.5.2-alpha.6 | 9.5.2-alpha.6 |
| GHSA-72hp-qff8-4pvv Parse Server has a protected fields bypass via logical query operators |
Medium EPSS 0.32% |
< 8.6.19 | 8.6.19 |
| GHSA-48mh-j4p5-7j9v Parse Server missing audience validation in Keycloak authentication adapter |
High EPSS 0.45% |
< 8.6.18 | 8.6.18 |
| GHSA-48mh-j4p5-7j9v Parse Server missing audience validation in Keycloak authentication adapter |
High EPSS 0.45% |
>= 9.0.0, < 9.5.2-alpha.5 | 9.5.2-alpha.5 |
| GHSA-hcj7-6gxh-24ww Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload |
Medium EPSS 0.22% |
>= 9.0.0, < 9.5.2-alpha.4 | 9.5.2-alpha.4 |
| GHSA-hcj7-6gxh-24ww Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload |
Medium EPSS 0.22% |
< 8.6.17 | 8.6.17 |
| GHSA-7ch5-98q2-7289 Parse Server has a bypass of class-level permissions in LiveQuery |
High EPSS 0.44% |
< 8.6.16 | 8.6.16 |
| GHSA-7ch5-98q2-7289 Parse Server has a bypass of class-level permissions in LiveQuery |
High EPSS 0.44% |
>= 9.0.0, < 9.5.2-alpha.3 | 9.5.2-alpha.3 |
| GHSA-cmj3-wx7h-ffvg Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API |
High EPSS 0.58% |
< 8.6.15 | 8.6.15 |
| GHSA-cmj3-wx7h-ffvg Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API |
High EPSS 0.58% |
>= 9.0.0, < 9.5.2-alpha.2 | 9.5.2-alpha.2 |
| GHSA-qpr4-jrj4-6f27 Parse Server: SQL injection via dot-notation field name in PostgreSQL |
Critical EPSS 0.43% |
>= 9.0.0, < 9.6.0-alpha.2 | 9.6.0-alpha.2 |
| GHSA-qpr4-jrj4-6f27 Parse Server: SQL injection via dot-notation field name in PostgreSQL |
Critical EPSS 0.43% |
< 8.6.28 | 8.6.28 |
| GHSA-vgjh-hmwf-c588 Parse Server has a NoSQL injection via token type in password reset and email verification endpoints |
High EPSS 0.47% |
>= 9.0.0, < 9.5.2-alpha.1 | 9.5.2-alpha.1 |
| GHSA-vgjh-hmwf-c588 Parse Server has a NoSQL injection via token type in password reset and email verification endpoints |
High EPSS 0.47% |
< 8.6.14 | 8.6.14 |
| GHSA-5j86-7r7m-p8h6 Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution |
High EPSS 0.51% |
>= 9.0.0-alpha.1, < 9.5.1-alpha.2 | 9.5.1-alpha.2 |
| GHSA-5j86-7r7m-p8h6 Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution |
High EPSS 0.51% |
< 8.6.13 | 8.6.13 |
| GHSA-q342-9w2p-57fp Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement |
Medium EPSS 0.42% |
>= 9.0.0-alpha.1, < 9.5.1-alpha.1 | 9.5.1-alpha.1 |
| GHSA-q342-9w2p-57fp Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement |
Medium EPSS 0.42% |
< 8.6.12 | 8.6.12 |
| GHSA-mf3j-86qx-cq5j Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery |
High EPSS 0.47% |
>= 9.0.0-alpha.1, < 9.5.0-alpha.14 | 9.5.0-alpha.14 |
| GHSA-mf3j-86qx-cq5j Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery |
High EPSS 0.47% |
< 8.6.11 | 8.6.11 |
| GHSA-x6fw-778m-wr9v Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters |
Critical EPSS 0.55% |
< 8.6.10 | 8.6.10 |
| GHSA-x6fw-778m-wr9v Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters |
Critical EPSS 0.55% |
>= 9.0.0-alpha.1, < 9.5.0-alpha.11 | 9.5.0-alpha.11 |
| GHSA-q5q9-2rhp-33qw Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled |
Medium EPSS 0.29% |
>= 9.3.1-alpha.3, < 9.5.0-alpha.10 | 9.5.0-alpha.10 |
| GHSA-hwx8-q9cg-mqmc Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization |
Medium EPSS 0.31% |
< 8.6.9 | 8.6.9 |
| GHSA-hwx8-q9cg-mqmc Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization |
Medium EPSS 0.31% |
>= 9.0.0-alpha.1, < 9.5.0-alpha.9 | 9.5.0-alpha.9 |
| GHSA-hm3f-q6rw-m6wh Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory |
Low EPSS 0.33% |
>= 9.0.0-alpha.1, < 9.5.0-alpha.8 | 9.5.0-alpha.8 |
| GHSA-hm3f-q6rw-m6wh Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory |
Low EPSS 0.33% |
< 8.6.8 | 8.6.8 |
| GHSA-9cp7-3q5w-j92g parse-server: Malformed `$regex` query leaks database error details in API response |
Medium EPSS 0.35% |
< 8.6.7 | 8.6.7 |
| GHSA-9cp7-3q5w-j92g parse-server: Malformed `$regex` query leaks database error details in API response |
Medium EPSS 0.35% |
>= 9.0.0, < 9.5.0-alpha.6 | 9.5.0-alpha.6 |
| GHSA-79wj-8rqv-jvp5 parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user |
High EPSS 0.40% |
>= 9.0.0, < 9.5.0-alpha.4 | 9.5.0-alpha.4 |
| GHSA-79wj-8rqv-jvp5 parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user |
High EPSS 0.40% |
< 8.6.6 | 8.6.6 |
| GHSA-xfh7-phr7-gr2x parse-server's file creation and deletion bypasses `readOnlyMasterKey` write restriction |
Medium EPSS 0.34% |
< 8.6.5 | 8.6.5 |
| GHSA-xfh7-phr7-gr2x parse-server's file creation and deletion bypasses `readOnlyMasterKey` write restriction |
Medium EPSS 0.34% |
>= 9.0.0, < 9.5.0-alpha.3 | 9.5.0-alpha.3 |
| GHSA-vc89-5g3r-cmhh Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction |
High EPSS 0.40% |
< 8.6.4 | 8.6.4 |
| GHSA-vc89-5g3r-cmhh Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction |
High EPSS 0.40% |
>= 9.0.0, < 9.4.1-alpha.3 | 9.4.1-alpha.3 |
| GHSA-4q3h-vp4r-prv2 Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter |
Critical EPSS 0.20% |
>= 9.0.0, < 9.3.1-alpha.4 | 9.3.1-alpha.4 |
| GHSA-4q3h-vp4r-prv2 Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter |
Critical EPSS 0.20% |
< 8.6.3 | 8.6.3 |
| GHSA-3f5f-xgrj-97pf Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter |
Medium EPSS 0.33% |
>= 9.0.0, < 9.1.1-alpha.1 | 9.1.1-alpha.1 |
| GHSA-3f5f-xgrj-97pf Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter |
Medium EPSS 0.33% |
< 8.6.2 | 8.6.2 |
| GHSA-jhgf-2h8h-ggxv Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables |
Medium EPSS 0.22% |
< 8.6.1 | 8.6.1 |
| GHSA-jhgf-2h8h-ggxv Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables |
Medium EPSS 0.22% |
>= 9.0.0, < 9.1.0-alpha.3 | 9.1.0-alpha.3 |
| GHSA-7cx5-254x-cgrq Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details |
Medium EPSS 0.45% |
< 8.5.0-alpha.5 | 8.5.0-alpha.5 |
| GHSA-x4qj-2f4q-r4rx Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format |
High EPSS 0.65% |
>= 4.2.0, < 7.5.4 | 7.5.4 |
| GHSA-x4qj-2f4q-r4rx Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format |
High EPSS 0.65% |
>= 8.0.0, < 8.4.0-alpha.2 | 8.4.0-alpha.2 |
| GHSA-48q3-prgv-gm4w Parse Server exposes the data schema via GraphQL API |
Medium EPSS 0.96% |
>= 8.0.0, < 8.2.2 | 8.2.2 |
| GHSA-48q3-prgv-gm4w Parse Server exposes the data schema via GraphQL API |
Medium EPSS 0.96% |
>= 5.3.0, < 7.5.3 | 7.5.3 |
| GHSA-837q-jhwx-cmpv Parse Server has an OAuth login vulnerability |
Medium EPSS 0.41% |
< 7.5.2 | 7.5.2 |
| GHSA-837q-jhwx-cmpv Parse Server has an OAuth login vulnerability |
Medium EPSS 0.41% |
>= 8.0.0, < 8.0.2 | 8.0.2 |
| GHSA-8xq9-g7ch-35hg Parse Server's custom object ID allows to acquire role privileges |
High EPSS 0.42% |
>= 7.0.0, < 7.3.0 | 7.3.0 |
| GHSA-8xq9-g7ch-35hg Parse Server's custom object ID allows to acquire role privileges |
High EPSS 0.42% |
< 6.5.9 | 6.5.9 |
| GHSA-c2hr-cqg6-8j6r ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability |
Critical EPSS 20.17% |
< 6.5.7 | 6.5.7 |
| GHSA-c2hr-cqg6-8j6r ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability |
Critical EPSS 20.17% |
>= 7.0.0, < 7.1.0 | 7.1.0 |
| GHSA-6hh7-46r2-vf29 Server crashes on invalid Cloud Function or Cloud Job name |
Critical EPSS 1.19% |
< 6.5.5 | 6.5.5 |
| GHSA-6hh7-46r2-vf29 Server crashes on invalid Cloud Function or Cloud Job name |
Critical EPSS 1.19% |
>= 7.0.0-alpha.1, < 7.0.0-alpha.29 | 7.0.0-alpha.29 |
| GHSA-6927-3vr9-fxf2 ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection |
Critical EPSS 1.03% |
>= 7.0.0-alpha.1, < 7.0.0-alpha.20 | 7.0.0-alpha.20 |
| GHSA-6927-3vr9-fxf2 ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection |
Critical EPSS 1.03% |
< 6.5.0 | 6.5.0 |
| GHSA-792q-q67h-w579 Parse Server may crash when uploading file without extension |
High EPSS 1.32% |
>= 1.0.0, < 5.5.6 | 5.5.6 |
| GHSA-792q-q67h-w579 Parse Server may crash when uploading file without extension |
High EPSS 1.32% |
>= 6.0.0, < 6.3.1 | 6.3.1 |
| GHSA-fcv6-fg5r-jm9q Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer |
High EPSS 0.77% |
>= 1.0.0, < 5.5.5 | 5.5.5 |
| GHSA-fcv6-fg5r-jm9q Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer |
High EPSS 0.77% |
>= 6.0.0, < 6.2.2 | 6.2.2 |
| GHSA-462x-c3jw-7vr6 Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution |
Critical EPSS 3.20% |
>= 6.0.0, < 6.2.1 | 6.2.1 |
| GHSA-462x-c3jw-7vr6 Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution |
Critical EPSS 3.20% |
< 5.5.2 | 5.5.2 |
| GHSA-9prm-jqwx-45x9 Phishing attack vulnerability by uploading malicious HTML file |
Medium EPSS 0.64% |
>= 6.0.0, < 6.1.1 | 6.1.1 |
| GHSA-9prm-jqwx-45x9 Phishing attack vulnerability by uploading malicious HTML file |
Medium EPSS 0.64% |
< 5.4.4 | 5.4.4 |
| GHSA-vm5r-c87r-pf6x Parse Server option `masterKeyIps` vulnerability to IP spoofing |
High EPSS 0.66% |
< 5.4.1 | 5.4.1 |
| GHSA-93vw-8fm5-p2jf Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks |
Critical EPSS 0.88% |
>= 5.0.0, < 5.3.3 | 5.3.3 |
| GHSA-93vw-8fm5-p2jf Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks |
Critical EPSS 0.88% |
< 4.10.20 | 4.10.20 |
| GHSA-xprv-wvh7-qqqx Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers |
Critical EPSS 0.95% |
>= 5.0.0, < 5.3.2 | 5.3.2 |
| GHSA-xprv-wvh7-qqqx Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers |
Critical EPSS 0.95% |
< 4.10.19 | 4.10.19 |
| GHSA-prm5-8g2m-24gg Remote code execution via MongoDB BSON parser through prototype pollution |
Critical EPSS 38.72% |
>= 5.0.0, < 5.3.1 | 5.3.1 |
| GHSA-prm5-8g2m-24gg Remote code execution via MongoDB BSON parser through prototype pollution |
Critical EPSS 38.72% |
< 4.10.18 | 4.10.18 |
| GHSA-h423-w6qv-2wj3 parse-server crashes when receiving file download request with invalid byte range |
High EPSS 0.81% |
>= 5.0.0, < 5.2.8 | 5.2.8 |
| GHSA-h423-w6qv-2wj3 parse-server crashes when receiving file download request with invalid byte range |
High EPSS 0.81% |
< 4.10.17 | 4.10.17 |
| GHSA-r657-33vp-gp22 parse-server auth adapter app ID validation can be circumvented |
Low EPSS 0.53% |
>= 5.0.0, < 5.2.7 | 5.2.7 |
| GHSA-r657-33vp-gp22 parse-server auth adapter app ID validation can be circumvented |
Low EPSS 0.53% |
< 4.10.16 | 4.10.16 |
| GHSA-6w4q-23cf-j9jp parse-server's session object properties can be updated by foreign user if object ID is known |
Medium EPSS 0.49% |
>= 5.0.0, < 5.2.6 | 5.2.6 |
| GHSA-6w4q-23cf-j9jp parse-server's session object properties can be updated by foreign user if object ID is known |
Medium EPSS 0.49% |
< 4.10.15 | 4.10.15 |
| GHSA-2m6g-crv8-p3c6 Parse Server vulnerable to brute force guessing of user sensitive data via search patterns |
High EPSS 1.26% |
>= 5.0.0, < 5.2.5 | 5.2.5 |
| GHSA-2m6g-crv8-p3c6 Parse Server vulnerable to brute force guessing of user sensitive data via search patterns |
High EPSS 1.26% |
< 4.10.14 | 4.10.14 |
| GHSA-crrq-vr9j-fxxh Protected fields exposed via LiveQuery |
High EPSS 1.34% |
>= 5.0.0, < 5.2.4 | 5.2.4 |
| GHSA-crrq-vr9j-fxxh Protected fields exposed via LiveQuery |
High EPSS 1.34% |
< 4.10.13 | 4.10.13 |
| GHSA-xw6g-jjvf-wwf9 Invalid file request can crash server |
High EPSS 1.16% |
< 4.10.12 | 4.10.12 |
| GHSA-xw6g-jjvf-wwf9 Invalid file request can crash server |
High EPSS 1.16% |
>= 5.0.0, < 5.2.3 | 5.2.3 |
| GHSA-rh9j-f5f8-rvgc Authentication bypass vulnerability in Apple Game Center auth adapter |
High EPSS 0.89% |
>= 5.0.0, < 5.2.2 | 5.2.2 |
| GHSA-rh9j-f5f8-rvgc Authentication bypass vulnerability in Apple Game Center auth adapter |
High EPSS 0.89% |
< 4.10.11 | 4.10.11 |
| GHSA-qf8x-vqjv-92gr Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter |
High EPSS 0.69% |
< 4.10.10 | 4.10.10 |
| GHSA-qf8x-vqjv-92gr Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter |
High EPSS 0.69% |
>= 5.0.0, < 5.2.1 | 5.2.1 |
| GHSA-p6h4-93qp-jhcm Command injection in Parse Server through prototype pollution |
Critical EPSS 49.36% |
< 4.10.7 | 4.10.7 |
| GHSA-7pr3-p5fm-8r9x LiveQuery publishes user session tokens in parse-server |
High EPSS 1.25% |
< 4.10.4 | 4.10.4 |
| GHSA-593v-wcqx-hq2w Incorrect version tags linked to external repository |
High EPSS 0.18% |
>= 4.0.0, < 4.5.2 | 4.5.2 |
| GHSA-593v-wcqx-hq2w Incorrect version tags linked to external repository |
High EPSS 0.18% |
>= 4.6.0, < 4.10.0 | 4.10.0 |
| GHSA-xqp8-w826-hh6x Parse Server crashes with query parameter |
High EPSS 1.82% |
< 4.10.3 | 4.10.3 |
| GHSA-23r4-5mxp-c7g5 parse-server new anonymous user session acts as if it's created with password |
Medium EPSS 0.99% |
< 4.5.2 | 4.5.2 |
| GHSA-4w46-w44m-3jq3 Parse Server stores password in plain text |
High EPSS 0.81% |
< 4.5.0 | 4.5.0 |
| GHSA-2xm2-xj2q-qgpj receiving subscription objects with deleted session |
Medium EPSS 1.17% |
< 4.4.0 | 4.4.0 |
| GHSA-236h-rqv8-8q73 GraphQL: Security breach on Viewer query |
Medium EPSS 1.07% |
>= 3.5.0, < 4.3.0 | 4.3.0 |
| GHSA-h4mf-75hf-67w4 Information disclosure in parse-server |
High EPSS 0.85% |
< 4.1.0 | 4.1.0 |
| GHSA-8w3j-g983-8jh5 Sensitive Data Exposure in parse-server |
Medium EPSS 1.16% |
< 3.6.0 | 3.6.0 |
| GHSA-2479-qvv7-47qq Parse Server before v3.4.1 vulnerable to Denial of Service |
High EPSS 1.40% |
< 3.4.1 | 3.4.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor