Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

parse-community/parse-server

              alpha @ 4d3465c
            

321

Fixes

CVEs

CRITICAL

Peak severity

54.5%

Coverage

Highlights

Auth Bypass: 138 prior fixes. Scrutinize any change in this area.

src/RestWrite.js: most-fixed (34 issues). Treat as high-risk during review.

210 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The Apple Game Center authentication adapter failed to validate certificate chains against a trusted root authority, allowing remote attackers to bypass authentication constraints.

SQL Injection: Increment operations on nested fields using dot-notation did not validate or escape key parameters, enabling remote attackers with REST write access to perform SQL injection.

Prototype Pollution: Unvalidated file tags and metadata were passed directly to database update operations, allowing prototype pollution via BSON parser keys such as __proto__ and constructor.