Executive brief
Parse Server, an open-source backend framework, was affected by a supply chain incident where unauthorized version tags were added to its official code repository. These tags pointed to unvetted code from a contributor's personal account rather than the official project code. While no official software releases were compromised, organizations that configured their systems to pull code directly from these specific Git tags may have inadvertently installed unreviewed and potentially insecure software.
Technical details
A supply chain vulnerability (CWE-494) occurred in Parse Server when a contributor with write access pushed version tags to the official repository that pointed to an unreviewed personal fork. While no official npm releases were published using these tags, the vulnerability affected users who defined git-based dependencies referencing the compromised tags (e.g., `parse-server#4.9.3`). Additionally, some third-party distributions, such as Bitnami images, reportedly ingested the incorrect tags. Although no explicitly malicious code was identified during the investigation, the unvetted nature of the code means security vulnerabilities or backdoors could not be ruled out. The issue was resolved by deleting the incorrect tags and releasing version 4.10.0.
Affected products
- Parse Community Parse Server < 4.10.0
Timeline
- 2021-07-21: other: Project maintainers first became aware of the issue
- 2021-09-03: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: CVE-2021-47987 published to NVD