CVE-2021-47986

Awaiting Analysis Awaiting Analysis - Queue

Parse Server Supply Chain Vulnerability Before 4.10.0

Publication date: 2026-06-25

Last updated on: 2026-07-30

Assigner: VulnCheck

Description

Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in dependency declarations to execute unreviewed and potentially malicious code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-30

Generated

2026-08-05

AI Q&A

2026-06-26

EPSS Evaluated

2026-08-04

NVD

CVE-2021-47986

EUVD

EUVD-2021-34852

Affected Vendors & Products

Vendor	Product	Version / Range
parseplatform	parse-server	4.0.0
parseplatform	parse-server	4.0.0
parseplatform	parse-server	4.0.0
parseplatform	parse-server	4.0.0
parseplatform	parse-server	4.0.0
parseplatform	parse-server	4.0.0
parseplatform	parse-server	4.0.10
parseplatform	parse-server	4.0.11
parseplatform	parse-server	4.0.12
parseplatform	parse-server	4.0.13
parseplatform	parse-server	4.0.14
parseplatform	parse-server	4.0.3
parseplatform	parse-server	4.0.4
parseplatform	parse-server	4.0.6
parseplatform	parse-server	4.0.7
parseplatform	parse-server	4.0.8
parseplatform	parse-server	4.0.9
parseplatform	parse-server	4.6.0
parseplatform	parse-server	4.6.0
parseplatform	parse-server	4.7.0
parseplatform	parse-server	4.8.0
parseplatform	parse-server	4.8.1
parseplatform	parse-server	4.8.2
parseplatform	parse-server	4.8.3
parseplatform	parse-server	4.8.4
parseplatform	parse-server	4.8.5
parseplatform	parse-server	4.9.0
parseplatform	parse-server	4.9.1
parseplatform	parse-server	4.9.2
parseplatform	parse-server	4.9.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-494	The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Parse Server versions before 4.10.0 and is a supply chain issue. Incorrect version tags were pushed to the repository, which linked to unreviewed code in a personal fork. Attackers could exploit this by specifying these affected version tags in dependency declarations, causing the system to execute unreviewed and potentially malicious code.

Detection Guidance

This vulnerability involves incorrect version tags in the Parse Server repository linking to unreviewed code. Detection would primarily involve verifying the version of Parse Server in use and inspecting dependency declarations for affected version tags.

You can check the installed Parse Server version by running the following command in your environment:

npm list parse-server

Alternatively, if you use yarn:

yarn list --pattern parse-server

If the version is between 4.0.0-beta1 and 4.9.3, your system may be affected. Additionally, you can inspect your package.json or dependency lock files for any references to these vulnerable versions.

Impact Analysis

The vulnerability can lead to the execution of unreviewed and potentially malicious code within your environment. This could result in unauthorized actions, data compromise, or system instability due to the supply chain attack vector.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, it is recommended to upgrade Parse Server to version 4.10.0 or later, where the issue has been fixed.

If upgrading is not immediately possible, a temporary workaround is to downgrade to version 4.5.2, which is not affected by the incorrect version tags.

Additionally, review your dependency declarations to ensure no malicious or unreviewed version tags are specified.

Hi! I’m here to help you understand CVE-2021-47986. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70