Supply Chain Incident in Parse Server by Parse Community

CVE-2021-47987

What is CVE-2021-47987?

Parse Server, prior to version 4.10.0, experienced a supply chain incident that involved the unintended publication of incorrect version tags to its official repository. These tags pointed to a contributor's unreviewed personal fork, raising concerns over potential security issues. Although no malicious code was detected, the lack of review for the code associated with these tags could have allowed for the introduction of unaddressed vulnerabilities. Developers using git-based dependencies referencing these affected tags may have inadvertently exposed their projects to security risks.

References