CVE-2021-47987

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.0

Description A supply chain incident occurred where incorrect version tags were pushed to the official repository. These tags pointed to an unreviewed personal fork of a contributor who had write access. Exposure occurred only if a project defined a git-based dependency referencing one of the affected tags. Although no malicious code was identified, the code was not reviewed or approved, meaning the introduction of security vulnerabilities cannot be ruled out.

Recommendations Update Parse Server to version 4.10.0 or later. Avoid using git-based dependencies that reference unverified version tags.