CVE-2026-119569

Parse Server versions before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 are vulnerable to a prototype pollution vulnerability. The root cause is the lack of own-property checks when expanding user-controlled keys into objects. An attacker with class write access can submit dot notation field keys or...