Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building objects for Cloud Code triggers and LiveQuery, where a dot notation key whose intermediate segment resolves through an inherited member writes onto a process-wide built-in. Clients with write access to an object in a class with a trigger or LiveQuery can corrupt a built-in function, making unrelated requests fail until restart and denying service to all clients and hosted applications.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…server/security/advisories/GHSA-95hp-82c6-25q5 Üretici bülteni
• github.com/parse-community/parse-server/pull/10810 Yama
• github.com/parse-community/parse-server/pull/10811 Yama
• vulncheck.com/…pha.5-prototype-pollution-via-dot-notation-key Üçüncü taraf

Kayıt geçmişi

1. 4 Kas 2026 18:33Yayımlandı

İlgili açıklar

• 3,1 CVE-2026-122301Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response
• 3,7 CVE-2026-121415Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key
• 5,9 CVE-2026-121414Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update
• 3,1 CVE-2026-121413Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession
• 3,1 CVE-2026-120310Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response
• 3,1 CVE-2026-119570Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses