CVE-2021-47986: Parse Server - Unreviewed Code Execution via Malicious Version Tags

Q: What is the severity of CVE-2021-47986?

The severity of CVE-2021-47986 is rated high with a score of 7.7.

Q: How do I fix CVE-2021-47986?

To fix CVE-2021-47986, upgrade to Parse Server version 4.10.0 or later.

Q: What type of vulnerability is CVE-2021-47986?

CVE-2021-47986 is a supply chain vulnerability allowing code execution via malicious version tags.

Q: What impact does CVE-2021-47986 have on Parse Server?

CVE-2021-47986 allows attackers to execute unreviewed code by specifying affected version tags.

Q: Which versions of Parse Server are affected by CVE-2021-47986?

CVE-2021-47986 affects all versions of Parse Server prior to 4.10.0.

Published Jun 25, 2026

Updated

Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in dependency declarations to execute unreviewed and potentially malicious code.

Affected Software

31 affected components

Parse Parse Server<4.10.0

parseplatform Parse-server Node.js=4.0.0-beta1

parseplatform Parse-server Node.js=4.0.0-beta2

parseplatform Parse-server Node.js=4.0.0-beta3

parseplatform Parse-server Node.js=4.0.0-beta4

parseplatform Parse-server Node.js=4.0.0-beta5

parseplatform Parse-server Node.js=4.0.0-beta6

parseplatform Parse-server Node.js=4.0.3

parseplatform Parse-server Node.js=4.0.4

parseplatform Parse-server Node.js=4.0.6

parseplatform Parse-server Node.js=4.0.7

parseplatform Parse-server Node.js=4.0.8

parseplatform Parse-server Node.js=4.0.9

parseplatform Parse-server Node.js=4.0.10

parseplatform Parse-server Node.js=4.0.11

parseplatform Parse-server Node.js=4.0.12

parseplatform Parse-server Node.js=4.0.13

parseplatform Parse-server Node.js=4.0.14

parseplatform Parse-server Node.js=4.6.0

parseplatform Parse-server Node.js=4.6.0-beta

parseplatform Parse-server Node.js=4.7.0

parseplatform Parse-server Node.js=4.8.0

parseplatform Parse-server Node.js=4.8.1

parseplatform Parse-server Node.js=4.8.2

parseplatform Parse-server Node.js=4.8.3

parseplatform Parse-server Node.js=4.8.4

parseplatform Parse-server Node.js=4.8.5

parseplatform Parse-server Node.js=4.9.0

parseplatform Parse-server Node.js=4.9.1

parseplatform Parse-server Node.js=4.9.2

parseplatform Parse-server Node.js=4.9.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Parse Server to a version that resolves this vulnerability.
Fixed in 4.10.0
Compensating control
Ensure dependency declarations do not specify affected Parse Server version tags that could resolve to unreviewed/personal-fork code.

Event History

Jun 25, 2026

CVE Published

via MITRE·09:41 PM

Data Sourced

via MITRE·09:41 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2021-47986?

The severity of CVE-2021-47986 is rated high with a score of 7.7.

How do I fix CVE-2021-47986?

To fix CVE-2021-47986, upgrade to Parse Server version 4.10.0 or later.

What type of vulnerability is CVE-2021-47986?

CVE-2021-47986 is a supply chain vulnerability allowing code execution via malicious version tags.

What impact does CVE-2021-47986 have on Parse Server?