En bref
- CVE-2026-31840 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant parse-server (parseplatform), parse-server.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.43%, plus élevée que 37.6% des vulnérabilités.
- Correctif : mettre à jour vers 9.6.0, 8.6.28, 9.6.0-alpha.2 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| parse-server | = 9.6.0≥ 9.0.0, < 9.6.0< 8.6.28
| 9.6.08.6.28
|
| parse-server npm | ≥ 9.0.0, < 9.6.0-alpha.2< 8.6.28
| 9.6.0-alpha.28.6.28
|
Description
Impact
An attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters.
This vulnerability only affects deployments using a PostgreSQL database.
Patches
The fix escapes characters in dot-notation sub-field values that could allow a SQL breakout.
Workarounds
There is no known workaround.
References
NVD description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.2 and 8.6.28, an attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters. This vulnerability only affects deployments using a PostgreSQL database. This vulnerability is fixed in 9.6.0-alpha.2 and 8.6.28.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free