{"id":"GHSA-6hh7-46r2-vf29","summary":"Server crashes on invalid Cloud Function or Cloud Job name","details":"### Impact\n\nCalling an invalid Parse Server Cloud Function name or Cloud Job name crashes server and may allow for code injection.\n\n### Patches\n\nAdded string sanitation for Cloud Function name and Cloud Job name.\n\n### Workarounds\n\nSanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.\n\n### References\n\n- https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29\n- https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 (Fix for Parse Server 7 alpha)\n- https://github.com/parse-community/parse-server/releases/tag/6.5.5 (Fix for Parse Server 6 LTS)","aliases":["BIT-parse-2024-29027","CVE-2024-29027"],"modified":"2026-09-10T03:50:10.184177274Z","published":"2024-03-19T20:07:35Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2024-03-19T20:07:35Z","nvd_published_at":"2024-03-19T19:15:06Z","cwe_ids":["CWE-20","CWE-74"],"severity":"CRITICAL"},"references":[{"type":"WEB","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29027"},{"type":"WEB","url":"https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b"},{"type":"WEB","url":"https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e"},{"type":"PACKAGE","url":"https://github.com/parse-community/parse-server"},{"type":"WEB","url":"https://github.com/parse-community/parse-server/releases/tag/6.5.5"},{"type":"WEB","url":"https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29"}],"affected":[{"package":{"name":"parse-server","ecosystem":"npm","purl":"pkg:npm/parse-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.5.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-6hh7-46r2-vf29/GHSA-6hh7-46r2-vf29.json"}},{"package":{"name":"parse-server","ecosystem":"npm","purl":"pkg:npm/parse-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0-alpha.1"},{"fixed":"7.0.0-alpha.29"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-6hh7-46r2-vf29/GHSA-6hh7-46r2-vf29.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}]}