GHSA-462x-c3jw-7vr6

### Impact

An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser.

### Patches

Prevent prototype pollution in MongoDB database adapter.

### Workarounds

Disable remote code execution through the MongoDB BSON parser.

### Credits

- Discovered by hir0ot working with Trend Micro Zero Day Initiative
- Fixed by dbythy
- Reviewed by mtrezza

### References

- https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6
- https://github.com/advisories/GHSA-prm5-8g2m-24gg

npm parse-server

Affected versions: 0 (fixed in 5.5.2)

npm parse-server

Affected versions: 6.0.0 (fixed in 6.2.1)

CVE-2023-36475

Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution