Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter

Description

An attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **< 8.6.59

  >= 9.0.0, < 9.6.0-alpha.53**

• Patched version(s): **8.6.59

  9.6.0-alpha.53**

References

• GHSA-p2w6-rmh7-w8q3
• CVE-2026-33539
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Parse Server has a SQL injection via query field name when using PostgreSQL - CVE-2026-32234
• Parse Server: SQL injection via dot-notation field name in PostgreSQL - CVE-2026-31840
• Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL - CVE-2026-31856
• Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL - CVE-2026-31871

Tags:

npm

parse-server