What is GHSA-5gp4-jgm9-v67j?

GHSA-5gp4-jgm9-v67j is a security advisory published by GitHub Security Advisories with Medium severity. Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution...

Which CVE IDs does GHSA-5gp4-jgm9-v67j cover?

GHSA-5gp4-jgm9-v67j covers the following CVE IDs: CVE-2026-119569. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5gp4-jgm9-v67j?

GHSA-5gp4-jgm9-v67j has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-5gp4-jgm9-v67jMediumCVSS 5.3

Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution...

Vendor

GitHub Security Advisories

Published

October 30, 2026

Last Modified

October 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-119569 →

📋 Description

Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-property checks. Clients with class write access can send dot notation field keys or ACL entry names matching built-in object members to corrupt built-in functions, causing all requests to fail until server restart.

🔗 References (4)

https://github.com/parse-community/parse-server/security/advisories/GHSA-rx55-fw4j-pvpx
https://nvd.nist.gov/vuln/detail/CVE-2026-119569
https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.9-prototype-pollution-denial-of-service
https://github.com/advisories/GHSA-5gp4-jgm9-v67j