Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-rede-vp9p-wyeq
Vulnerability ID VCID-rede-vp9p-wyeq
Aliases CVE-2022-24760
GHSA-p6h4-93qp-jhcm
Summary Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows. Users are advised to upgrade as soon as possible. The only known workaround is to manually patch your installation with code referenced at the source GHSA-p6h4-93qp-jhcm.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
System Score Found at
epss 0.75565 https://api.first.org/data/v1/epss?cve=CVE-2022-24760
epss 0.75565 https://api.first.org/data/v1/epss?cve=CVE-2022-24760
epss 0.75565 https://api.first.org/data/v1/epss?cve=CVE-2022-24760
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-p6h4-93qp-jhcm
cvssv3.1 10.0 https://github.com/parse-community/parse-server
generic_textual CRITICAL https://github.com/parse-community/parse-server
cvssv3.1 10 https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d
cvssv3.1 10.0 https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d
generic_textual CRITICAL https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d
ssvc Track* https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d
cvssv3.1 10 https://github.com/parse-community/parse-server/security/advisories/GHSA-p6h4-93qp-jhcm
cvssv3.1 10.0 https://github.com/parse-community/parse-server/security/advisories/GHSA-p6h4-93qp-jhcm
cvssv3.1_qr CRITICAL https://github.com/parse-community/parse-server/security/advisories/GHSA-p6h4-93qp-jhcm
generic_textual CRITICAL https://github.com/parse-community/parse-server/security/advisories/GHSA-p6h4-93qp-jhcm
ssvc Track* https://github.com/parse-community/parse-server/security/advisories/GHSA-p6h4-93qp-jhcm
cvssv3.1 10.0 https://nvd.nist.gov/vuln/detail/CVE-2022-24760
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2022-24760
cvssv3.1 10.0 https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099
generic_textual CRITICAL https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099
cvssv3.1 10 https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099/
ssvc Track* https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099/
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-24760
https://github.com/parse-community/parse-server
https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d
https://nvd.nist.gov/vuln/detail/CVE-2022-24760
https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099
ac24b343-e7da-4bc7-ab38-4f4f5cc9d099 https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099/
GHSA-p6h4-93qp-jhcm https://github.com/advisories/GHSA-p6h4-93qp-jhcm
GHSA-p6h4-93qp-jhcm https://github.com/parse-community/parse-server/security/advisories/GHSA-p6h4-93qp-jhcm
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/parse-community/parse-server
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-04-22T15:37:33Z/ Found at https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-p6h4-93qp-jhcm
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-p6h4-93qp-jhcm
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-04-22T15:37:33Z/ Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-p6h4-93qp-jhcm
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-24760
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Found at https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Found at https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-04-22T15:37:33Z/ Found at https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099/
Exploit Prediction Scoring System (EPSS)
Percentile 0.98916
EPSS Score 0.75565
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:41:47.191246+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/parse-server/CVE-2022-24760.yml 38.6.0