Homepage

parse@3.4.0 vulnerabilities

Parse JavaScript SDK

  • latest version

    7.0.2

  • latest non vulnerable version

    7.0.2

  • first published

    13 years ago

  • latest version published

    1 days ago

  • licenses detected

    • BSD-3-Clause
      >=1.6.4 <4.0.0-alpha.8; >=4.0.0-beta.1 <4.0.1-beta.1
  • View parse package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the parse package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Prototype Pollution

    parse is a library that gives you access to the powerful Parse Server backend from your JavaScript app.

    Affected versions of this package are vulnerable to Prototype Pollution which allows an attacker to execute arbitrary code remotely by injecting a malicious payload into affected APIs, including: ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations, and encode/decode.

    How to fix Prototype Pollution?

    Upgrade parse to version 7.0.0-alpha.1 or higher.

    <7.0.0-alpha.1
    • H
    Prototype Pollution

    parse is a library that gives you access to the powerful Parse Server backend from your JavaScript app.

    Affected versions of this package are vulnerable to Prototype Pollution via the initializeState() function. An attacker can cause a denial of service by injecting malicious properties into Object.prototype by specifying a className value of 'proto'.

    Note: The vulnerability was fixed in 7.0.0; however, the maintainer recommends skipping this release as it contains a bug that introduces a breaking change in the format of Parse Server 5xx responses.

    How to fix Prototype Pollution?

    Upgrade parse to version 7.0.1 or higher.

    <7.0.1
    Go back to all versions of this package