Description Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-alpha.53.
A SQL injection vulnerability has been identified in Parse Server versions prior to 8.6.59 and 9.6.0-alpha.53, specifically in deployments using PostgreSQL. An attacker with master key access can exploit this vulnerability by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This exploitation allows for arbitrary SQL execution on the PostgreSQL database, leading to privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access.
Users can upgrade to Parse Server versions 8.6.59 or 9.6.0-alpha.53, where this vulnerability has been patched.
Show AI summary Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 26, 2026 Exploitation: NoneAutomatable: NoTechnical Impact: Total
References to Advisories, Solutions, and Tools By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [email protected]
Affected Products Product Versions parseplatform parse-server < 8.6.59
>= 9.0.0, < 9.6.0
9.6.0 alpha1
9.6.0 alpha10
9.6.0 alpha11
9.6.0 alpha12
9.6.0 alpha13
9.6.0 alpha14
9.6.0 alpha15
9.6.0 alpha16
9.6.0 alpha17
9.6.0 alpha18
9.6.0 alpha19
9.6.0 alpha2
9.6.0 alpha20
9.6.0 alpha21
9.6.0 alpha22
9.6.0 alpha23
9.6.0 alpha24
9.6.0 alpha25
9.6.0 alpha26
9.6.0 alpha27
9.6.0 alpha28
9.6.0 alpha29
9.6.0 alpha3
9.6.0 alpha30
9.6.0 alpha31
9.6.0 alpha32
9.6.0 alpha33
9.6.0 alpha34
9.6.0 alpha35
9.6.0 alpha36
9.6.0 alpha37
9.6.0 alpha38
9.6.0 alpha39
9.6.0 alpha4
9.6.0 alpha40
9.6.0 alpha41
9.6.0 alpha42
9.6.0 alpha43
9.6.0 alpha44
9.6.0 alpha45
9.6.0 alpha46
9.6.0 alpha47
9.6.0 alpha48
9.6.0 alpha49
9.6.0 alpha5
9.6.0 alpha50
9.6.0 alpha51
9.6.0 alpha52
9.6.0 alpha6
9.6.0 alpha7
9.6.0 alpha8
9.6.0 alpha9
Viewing 5 of 54 versions. View all CPE cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha12:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha13:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha14:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha15:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha16:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha17:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha18:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha19:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha2:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha20:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha21:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha22:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha23:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha24:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha25:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha26:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha27:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha28:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha29:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha3:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha30:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha31:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha32:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha33:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha34:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha35:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha36:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha37:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha38:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha39:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha4:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha40:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha41:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha42:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha43:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha44:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha45:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha46:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha47:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha48:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha49:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha5:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha50:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha51:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha52:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha6:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha7:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha8:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha9:*:*:*:node.js:*:* Remediation No remediation found in references.
Change History 4 change records found show changes