Inclusion of Functionality from Untrusted Control Sphere in Parse Server - CVE-2021-47986
Published: April 6, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU124965
CSH Severity: Low
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-47986
CWE-ID: CWE-829
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to introduce unreviewed code into deployments.
The vulnerability exists due to improper control of version tags in the repository metadata in parse-server version tags when resolving a dependency from affected git tags. A remote user can reference a repository dependency pinned to an incorrect version tag to introduce unreviewed code into deployments.
The issue affects environments that install Parse Server directly from git version tags, and Bitnami images may also be affected if they incorporated the incorrect 4.9.3 tag.
Affected software
Parse Server
How to mitigate CVE-2021-47986
Install security update from vendor's website.
Parse Server - update to 4.10.0