EUVD-2026-14976
GHSA-p2w6-rmh7-w8q3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-alpha.53.
AnalysisAI
Parse Server versions prior to 8.6.59 and 9.6.0-alpha.53 contain a SQL injection vulnerability in PostgreSQL aggregate operations that allows attackers with master key access to execute arbitrary SQL statements, escalating from application-level administrator privileges to database-level access. Only PostgreSQL-backed Parse Server deployments are affected; MongoDB deployments are not vulnerable. No CVSS score or EPSS data is currently available, and no KEV or active exploitation reports have been confirmed at this time.
Technical ContextAI
Parse Server is a Node.js-based open-source backend framework (CPE: cpe:2.3:a:parse-community:parse-server:*:*:*:*:*:*:*:*) that supports multiple database backends including PostgreSQL and MongoDB. The vulnerability exists in the query pipeline stage processing, specifically within the $group aggregation pipeline stage and the distinct operation handlers. When field name parameters are passed to these operations without proper input sanitization, SQL metacharacters are insufficiently escaped before being embedded into dynamically constructed SQL queries executed against the PostgreSQL database. This represents a classic CWE-89 (SQL Injection) vulnerability where user-controlled input reaches SQL construction without adequate parameterization or escaping mechanisms.
RemediationAI
Immediately upgrade Parse Server to version 8.6.59 or later for the stable branch, or to version 9.6.0-alpha.53 or later for the alpha branch (see https://github.com/parse-community/parse-server/security/advisories/GHSA-p2w6-rmh7-w8q3 for detailed patching instructions). The patches implement proper input validation and parameterized query construction in the $group aggregation and distinct operation handlers (referenced in commits 03249f9bf5b8783c8b848f84dab791ff0b761b8c and bdddab5f8b61a40cb8fc62dd895887bdd2f3838e). As an interim compensating control before patching is feasible, restrict master key access to only trusted administrators, audit all aggregate and distinct operations in application logs, and consider disabling user-initiated aggregation pipelines until patching is complete. Note that MongoDB-backed Parse Server deployments are not affected and do not require patching.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-89 – SQL Injection
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today