Parse Server versions prior to 4.10.0 contain a supply chain flaw where incorrect git tags were pushed to the repository pointing to unreviewed code in a personal fork. An attacker can specify such malicious tags in dependency declarations, causing the server to install and execute unauthorized code. This leads to arbitrary code execution on the host, compromising confidentiality, integrity, and availability of the affected system. The weakness is the misuse of untrusted code from an external source, corresponding to CWE‑494.

The affected product is Parse Server from the parse-community maintainers. All releases before version 4.10.0 are vulnerable, regardless of platform, as the issue resides in the package distribution process.

The CVSS score of 7.7 indicates a high severity vulnerability that could allow remote code execution without user interaction. EPSS is not reported, but the lack of an official KEV listing suggests the vulnerability has not yet been publicly exploited at scale. The likely attack vector is through supply‑chain manipulation via dependency manifests, allowing an attacker to control which code is fetched and installed.