CVE-2022-41878

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the `requestKeywordDenylist` option. This issue is fixed in versions 4.10.19, and 5.3.2. If upgrade is not possible, the following Workarounds may be applied: Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.

• CWE-74
• CWE-1321
• CWE-1321

• https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqxThird Party Advisory
• https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqxThird Party Advisory

Published

Nov 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41871SEPPmail through 12.1.17 allows command injection within the…8.8
• CVE-2022-41873Contiki-NG is an open-source, cross-platform operating syste…5.4
• CVE-2022-41874Tauri is a framework for building binaries for all major des…4.7
• CVE-2022-41875A remote code execution (RCE) vulnerability in Optica allows…9.8
• CVE-2022-41876ezplatform-graphql is a GraphQL server implementation for Ib…5.3
• CVE-2022-41877FreeRDP is a free remote desktop protocol library and client…4.6
• CVE-2022-41879Parse Server is an open source backend that can be deployed …9.8
• CVE-2022-4188Insufficient validation of untrusted input in CORS in Google…4.3
• CVE-2022-41880TensorFlow is an open source platform for machine learning. …9.1
• CVE-2022-41881Netty project is an event-driven asynchronous network applic…7.5
• CVE-2022-41882The Nextcloud Desktop Client is a tool to synchronize files …7.8
• CVE-2022-41883TensorFlow is an open source platform for machine learning. …7.5