GHSA-vpj2-qq7w-5qq6
Suggest an improvement- Source
- https://github.com/advisories/GHSA-vpj2-qq7w-5qq6
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vpj2-qq7w-5qq6/GHSA-vpj2-qq7w-5qq6.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-vpj2-qq7w-5qq6
- Aliases
- Published
- 2026-03-31T23:48:38Z
- Modified
- 2026-04-01T00:06:52.733008Z
- Severity
-
- 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- parse-server has cloud function validator bypass via prototype chain traversal
- Details
-
Impact
An attacker can bypass Cloud Function validator access controls by appending
.prototype.constructorto the function name in the URL. When a Cloud Function handler is declared using thefunctionkeyword and its validator is a plain object or arrow function, the trigger store traversal resolves the handler through its own prototype chain while the validator store fails to mirror this traversal, causing all access control enforcement to be skipped.This allows unauthenticated callers to invoke Cloud Functions that are meant to be protected by validators such as
requireUser,requireMaster, or custom validation logic.Patches
The trigger store traversal now verifies that each intermediate node is a legitimate store object before continuing traversal. If the traversal encounters a non-store value such as a function handler, it stops and returns an empty store, preventing prototype chain escape.
Workarounds
Use arrow functions instead of the
functionkeyword for Cloud Function handlers. Arrow functions do not have aprototypeproperty and are not affected by this vulnerability.Resources
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6
- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10342
- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10343
- Database specific
{ "cwe_ids": [ "CWE-863" ], "github_reviewed": true, "nvd_published_at": "2026-03-31T15:16:20Z", "severity": "CRITICAL", "github_reviewed_at": "2026-03-31T23:48:38Z" }- References
-
- https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6
- https://nvd.nist.gov/vuln/detail/CVE-2026-34532
- https://github.com/parse-community/parse-server/pull/10342
- https://github.com/parse-community/parse-server/pull/10343
- https://github.com/parse-community/parse-server/commit/4fc48cf28f22eea200d74d883505f485234a48d7
- https://github.com/parse-community/parse-server/commit/dc59e272665644083c5b7f6862d88ce1ef0b2674
- https://github.com/parse-community/parse-server
Affected packages
npm / parse-server
Package
- Name
- parse-server
- View open source insights on deps.dev
- Purl
- pkg:npm/parse-server
npm / parse-server
Package
- Name
- parse-server
- View open source insights on deps.dev
- Purl
- pkg:npm/parse-server