CVE-2023-36475

Parse Server is a Node.js application backend, and this bug lets an unauthenticated attacker reach remote code execution through it: a prototype pollution sink corrupts JavaScript object internals, and that corruption is carried into the MongoDB BSON parser where it becomes code execution on the server. No login, no user interaction — a crafted request to the backend is enough, and Parse Server sits underneath whatever mobile or web app it powers.

Prototype pollution escalating to RCE is a well-understood and highly prized class in the Node ecosystem, and Parse Server is a general-purpose backend, so a compromise reaches the app's data store and application logic directly. Unauthenticated RCE in a deployable backend framework is the kind of finding that gets proof-of-concept attention quickly; the fixed versions 5.5.2 and 6.2.1 are the boundary between exposed and safe.

This is a dependency-inventory problem more than a scan-the-perimeter one. Parse Server arrives as an npm package buried in application stacks, so our job is to enumerate where it's used and pin the resolved version across every deployment, including containers and internal services. The advisory is easy to read; knowing every service that ships parse-server below 5.5.2 or 6.2.1 is the part that actually shortens the exposure window.