GHSA-prm5-8g2m-24gg

GitHub Security Advisory

Remote code execution via MongoDB BSON parser through prototype pollution

✓ GitHub Reviewed CRITICAL Has CVE

### Impact

An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser.

### Patches

Prevent prototype pollution in MongoDB database adapter.

### Workarounds

Disable remote code execution through the MongoDB BSON parser.

### Collaborators

Mikhail Shcherbakov (KTH), Cristian-Alexandru Staicu (CISPA) and Musard Balliu (KTH) working with Trend Micro Zero Day Initiative

### References

- https://github.com/parse-community/parse-server/security/advisories/GHSA-prm5-8g2m-24gg

npm parse-server

Affected versions: 0 (fixed in 4.10.18)

npm parse-server

Affected versions: 5.0.0 (fixed in 5.3.1)

CVE-2022-39396

GHSA ID

GHSA-prm5-8g2m-24gg

Published

November 8, 2022 5:29 PM

Last Modified

November 9, 2022 12:04 AM

CVSS Score

9.0 /10

Primary Ecosystem

npm

Primary Package

parse-server

GitHub Reviewed

✓ Yes

Last updated: July 9, 2025 6:27 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.