critical
CVE-2026-31840
Parse Server: SQL injection via dot-notation field name in PostgreSQL
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Bitnami9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Bitnami.
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.2 and 8.6.28, an attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters. This vulnerability only affects deployments using a PostgreSQL database. This vulnerability is fixed in 9.6.0-alpha.2 and 8.6.28.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | parse | 8.6.28, 9.6.0 |
| npm::GitHub Security Advisory npm | parse-server | 9.6.0-alpha.2, 8.6.28 |
References
- https://github.com/parse-community/parse-server
- https://github.com/parse-community/parse-server/releases/tag/8.6.28
- https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.2
- https://github.com/parse-community/parse-server/security/advisories/GHSA-qpr4-jrj4-6f27
- https://nvd.nist.gov/vuln/detail/CVE-2026-31840