CVE-2021-47986CWE-494

Parse Server - Unreviewed Code Execution via Malicious Version Tags

High · published June 25, 2026

CVSS v4.0
7.7
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in dependency declarations to execute unreviewed and potentially malicious code.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00180 · 7.1th percentile
Weakness
CWE-494 · Download of Code Without Integrity Check
Published
2026-06-25T21:41Z
EPSS history
Timeline
  • 25 JUN 21:41Z
    Parse Server - Unreviewed Code Execution via Malicious Version Tags
    cvelistv5