{"id":"CVE-2021-47986","details":"Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in dependency declarations to execute unreviewed and potentially malicious code.","aliases":["BIT-parse-2021-47986","CVE-2021-47987","GHSA-593v-wcqx-hq2w"],"modified":"2026-08-07T11:31:27.155597050Z","published":"2026-06-25T22:16:58.210Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"4.0.0-beta1"},{"last_affected":"4.0.0-beta1"},{"introduced":"4.0.0-beta2"},{"last_affected":"4.0.0-beta2"},{"introduced":"4.0.0-beta3"},{"last_affected":"4.0.0-beta3"},{"introduced":"4.0.0-beta4"},{"last_affected":"4.0.0-beta4"},{"introduced":"4.0.0-beta5"},{"last_affected":"4.0.0-beta5"},{"introduced":"4.0.0-beta6"},{"last_affected":"4.0.0-beta6"},{"introduced":"4.6.0-beta"},{"last_affected":"4.6.0-beta"}],"source":"CPE_STRING","vendor_product":"parseplatform:parse-server","cpes":["cpe:2.3:a:parseplatform:parse-server:4.0.0:beta1:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.0.0:beta2:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.0.0:beta3:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.0.0:beta4:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.0.0:beta5:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.0.0:beta6:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.6.0:beta:*:*:*:node.js:*:*"]}]},"references":[{"type":"ADVISORY","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-593v-wcqx-hq2w"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/parse-server-unreviewed-code-execution-via-malicious-version-tags"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/parse-community/parse-server","events":[{"introduced":"01bbfd7b43e21fbf365b4de06038a3d34fbbaa24"},{"last_affected":"c098889eebead744546bc78b13d31b86d95f6d02"}],"database_specific":{"cpe":["cpe:2.3:a:parseplatform:parse-server:4.0.3:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.0.4:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.0.6:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.0.7:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.0.8:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.0.9:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.0.10:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.0.11:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.0.12:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.0.13:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.0.14:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.6.0:-:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.7.0:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.8.0:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.8.1:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.8.2:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.8.3:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.8.4:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.8.5:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.9.0:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.9.1:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.9.2:*:*:*:*:node.js:*:*","cpe:2.3:a:parseplatform:parse-server:4.9.3:*:*:*:*:node.js:*:*"],"extracted_events":[{"introduced":"4.0.3"},{"last_affected":"4.0.3"},{"introduced":"4.0.4"},{"last_affected":"4.0.4"},{"introduced":"4.0.6"},{"last_affected":"4.0.6"},{"introduced":"4.0.7"},{"last_affected":"4.0.7"},{"introduced":"4.0.8"},{"last_affected":"4.0.8"},{"introduced":"4.0.9"},{"last_affected":"4.0.9"},{"introduced":"4.0.10"},{"last_affected":"4.0.10"},{"introduced":"4.0.11"},{"last_affected":"4.0.11"},{"introduced":"4.0.12"},{"last_affected":"4.0.12"},{"introduced":"4.0.13"},{"last_affected":"4.0.13"},{"introduced":"4.0.14"},{"last_affected":"4.0.14"},{"introduced":"4.6.0-NA"},{"last_affected":"4.6.0-NA"},{"introduced":"4.7.0"},{"last_affected":"4.7.0"},{"introduced":"4.8.0"},{"last_affected":"4.8.0"},{"introduced":"4.8.1"},{"last_affected":"4.8.1"},{"introduced":"4.8.2"},{"last_affected":"4.8.2"},{"introduced":"4.8.3"},{"last_affected":"4.8.3"},{"introduced":"4.8.4"},{"last_affected":"4.8.4"},{"introduced":"4.8.5"},{"last_affected":"4.8.5"},{"introduced":"4.9.0"},{"last_affected":"4.9.0"},{"introduced":"4.9.1"},{"last_affected":"4.9.1"},{"introduced":"4.9.2"},{"last_affected":"4.9.2"},{"introduced":"4.9.3"},{"last_affected":"4.9.3"}],"source":"CPE_STRING"}}],"versions":["4.0.10","4.0.11","4.0.12","4.0.13","4.0.14","4.0.3","4.0.4","4.0.6","4.0.7","4.0.8","4.0.9","4.6.0-NA","4.7.0","4.8.0","4.8.1","4.8.2","4.8.3","4.8.4","4.8.5","4.9.0","4.9.1","4.9.2","4.9.3","4.6.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-47986.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]}