요약
- CVE-2026-31840은(는) parse-server (parseplatform), parse-server에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.43%, 전체 취약점의 37.6%보다 높음.
- 조치: 9.6.0, 8.6.28, 9.6.0-alpha.2 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| parse-server | = 9.6.0≥ 9.0.0, < 9.6.0< 8.6.28
| 9.6.08.6.28
|
| parse-server npm | ≥ 9.0.0, < 9.6.0-alpha.2< 8.6.28
| 9.6.0-alpha.28.6.28
|
Description
Impact
An attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters.
This vulnerability only affects deployments using a PostgreSQL database.
Patches
The fix escapes characters in dot-notation sub-field values that could allow a SQL breakout.
Workarounds
There is no known workaround.
References
NVD description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.2 and 8.6.28, an attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters. This vulnerability only affects deployments using a PostgreSQL database. This vulnerability is fixed in 9.6.0-alpha.2 and 8.6.28.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free