EUVD-2026-14976
GHSA-p2w6-rmh7-w8q3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionGitHub Advisory
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-alpha.53.
AnalysisAI
Parse Server versions prior to 8.6.59 and 9.6.0-alpha.53 contain a SQL injection vulnerability in PostgreSQL aggregate operations that allows attackers with master key access to execute arbitrary SQL statements, escalating from application-level administrator privileges to database-level access. Only PostgreSQL-backed Parse Server deployments are affected; MongoDB deployments are not vulnerable. No CVSS score or EPSS data is currently available, and no KEV or active exploitation reports have been confirmed at this time.
Technical ContextAI
Parse Server is a Node.js-based open-source backend framework (CPE: cpe:2.3:a:parse-community:parse-server:*:*:*:*:*:*:*:*) that supports multiple database backends including PostgreSQL and MongoDB. The vulnerability exists in the query pipeline stage processing, specifically within the $group aggregation pipeline stage and the distinct operation handlers. When field name parameters are passed to these operations without proper input sanitization, SQL metacharacters are insufficiently escaped before being embedded into dynamically constructed SQL queries executed against the PostgreSQL database. This represents a classic CWE-89 (SQL Injection) vulnerability where user-controlled input reaches SQL construction without adequate parameterization or escaping mechanisms.
RemediationAI
Immediately upgrade Parse Server to version 8.6.59 or later for the stable branch, or to version 9.6.0-alpha.53 or later for the alpha branch (see https://github.com/parse-community/parse-server/security/advisories/GHSA-p2w6-rmh7-w8q3 for detailed patching instructions). The patches implement proper input validation and parameterized query construction in the $group aggregation and distinct operation handlers (referenced in commits 03249f9bf5b8783c8b848f84dab791ff0b761b8c and bdddab5f8b61a40cb8fc62dd895887bdd2f3838e). As an interim compensating control before patching is feasible, restrict master key access to only trusted administrators, audit all aggregate and distinct operations in application logs, and consider disabling user-initiated aggregation pipelines until patching is complete. Note that MongoDB-backed Parse Server deployments are not affected and do not require patching.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se
Same weakness CWE-89 – SQL Injection
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today