-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| parse-server | npm | < 4.10.13 | 4.10.13 |
| parse-server | npm | >= 5.0.0, < 5.2.4 | 5.2.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from missing protected field filtering in LiveQuery event handling. Key indicators: 1) The patch added a new _filterSensitiveData method to handle field removal 2) Modified event handlers to call this filtering 3) DatabaseController changes show schema handling improvements 4) Test case specifically checks protected field stripping. The original code only had ad-hoc sessionToken/authData removal but lacked systematic protected field handling via schema definitions, allowing exposure of any fields marked protected in class-level permissions.
JavaScriptJavaScriptOngoing coverage of React2Shell