[GHSA-p2x3-8689-cwpg] Parse Server's GraphQL WebSocket endpoint bypasses security middleware - #9630
Conversation
|
Hi there @mtrezza! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The advisory now consistently represents versions before 8.6.40 as affected.
Review effort: Balanced
Findings: None
What changed in this PR
Corrects the Parse Server advisory so the existing affected-version events consistently cover versions before 8.6.40.
Changes:
- Removes the stale
< 8.0.0affected-version metadata. - Updates the advisory modification timestamp.
| File | Description |
|---|---|
| advisories/github-reviewed/2026/03/GHSA-p2x3-8689-cwpg/GHSA-p2x3-8689-cwpg.json | Corrects affected-version metadata for Parse Server 8.x. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Makes sense, we've corrected the |
mtrezza
left a comment
mtrezza
left a comment
There was a problem hiding this comment.
Correct the version instead of removing block.
Hi @mtrezza ! The file is generated from the advisory, and this diff is what the improvement form produces for a range change. I changed the affected range of the 8.x entry from < 8.0.0 to < 8.6.40. The range is written to |
9258084
into
nikpivkin/advisory-improvement-9630
|
Hi @nikpivkin! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
Updates
Comments
The range of the 8.x entry should be < 8.6.40, not < 8.0.0. Now the whole 8.x branch from 8.0.0 to 8.6.39 is outside the range.
The 8.x fix parse-community/parse-server@21330d1 (#10190) is in tag 8.6.40 and not in tag 8.6.39. The 9.x fix is a separate commit (#10189) and is not part of the 8.x branch.