CVE-2024-29027

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation for Cloud Function name and Cloud Job name. As a workaround, sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.

• CWE-74

• https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179bPatch
• https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6ePatch
• https://github.com/parse-community/parse-server/releases/tag/6.5.5Release Notes
• https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29Release Notes
• https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29Vendor Advisory
• https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179bPatch
• https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6ePatch
• https://github.com/parse-community/parse-server/releases/tag/6.5.5Release Notes
• https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29Release Notes
• https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29Vendor Advisory

Published

Mar 19, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-29021Judge0 is an open-source online code execution system. The d…9
• CVE-2024-29022Xibo is an Open Source Digital Signage platform with a web c…8.8
• CVE-2024-29023Xibo is an Open Source Digital Signage platform with a web c…7.2
• CVE-2024-29024JumpServer is an open source bastion host and an operation a…5.3
• CVE-2024-29025Netty is an asynchronous event-driven network application fr…5.3
• CVE-2024-29026Owncast is an open source, self-hosted, decentralized, singl…9.1
• CVE-2024-29028memos is a privacy-first, lightweight note-taking service. I…5.3
• CVE-2024-29029memos is a privacy-first, lightweight note-taking service. I…6.1
• CVE-2024-2903A vulnerability was found in Tenda AC7 15.03.06.44. It has b…8.8
• CVE-2024-29030memos is a privacy-first, lightweight note-taking service. I…5.3
• CVE-2024-29031Meshery is an open source, cloud native manager that enables…7.5
• CVE-2024-29032Qiskit IBM Runtime is an environment that streamlines quantu…7.8