CVE-2026-119569

Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-property checks. Clients with class write access can send dot notation field keys or ACL entry names matching built-in object...

CVE-2026-119569

Parse Server versions before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 are vulnerable to a prototype pollution vulnerability. The root cause is the lack of own-property checks when expanding user-controlled keys into objects. An attacker with class write access can submit dot notation field keys or...