CVE-2026-31840
criticalpriority · track · 39EPSS 0.004 · 38 %ileEUUSEPSS · scored 2026-10-28
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.2 and 8.6.28, an attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters. This vulnerability only affects deployments using a PostgreSQL database. This vulnerability is fixed in 9.6.0-alpha.2 and 8.6.28.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.1–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (9)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-qpr4-jrj4-6f27Parse Server: SQL injection via dot-notation field name in PostgreSQL2026-03-10ghsa · osvUS
### Impact An attacker can use a dot-notation field name in combination with the `sort` query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the `distinct` and `where` query parameters. This vulnerability only affects deployments using a PostgreSQL database. ### Patches The fix escapes characters in dot-notation sub-field values that could allow a SQL breakout. ### Workarounds There is no known workaround. ### References - GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-qpr4-jrj4-6f27 - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.2 - Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.28
- BIT-parse-2026-31840Parse Server has a SQL injection via dot-notation field name in PostgreSQL2026-03-13vendor · osvUS
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0 and 8.6.28, an attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters. This vulnerability only affects deployments using a PostgreSQL database. This vulnerability is fixed in 9.6.0 and 8.6.28.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/parse-community/parse-serverPatchcnnvd
- https://github.com/parse-community/parse-server/releases/tag/8.6.28cnnvd
- https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.2cnnvd
- https://github.com/parse-community/parse-server/security/advisories/GHSA-qpr4-jrj4-6f27cnnvd
- https://github.com/parse-community/parse-server/releases/tag/8.6.28enisa_euvd
- https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.2enisa_euvd
- https://github.com/parse-community/parse-server/security/advisories/GHSA-qpr4-jrj4-6f27enisa_euvd
- https://github.com/parse-community/parse-server/releases/tag/8.6.28ProductRelease Notesnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan