CVE-2026-33539
published 2026-03-24CVE-2026-33539: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an…
PriorityP351high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.45%
36.0th percentile
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-alpha.53.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| parse-community | parse-server | < 8.6.59 | 8.6.59 |
| parse-community | parse-server | — | — |
| parse-community | parse-server | >= 0 < 8.6.59 | 8.6.59 |
| parse-community | parse-server | >= 9.0.0 < 9.6.0-alpha.53 | 9.6.0-alpha.53 |
| parseplatform | parse-server | < 8.6.59 | 8.6.59 |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | >= 9.0.0 < 9.6.0 | 9.6.0 |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.6HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
osv·2026-03-24
CVE-2026-33539 [HIGH] Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
### Impact
An attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate `$group` pipeline stage or the `distinct` operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access.
Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected.
### Patches
Field names in the aggregate `$group._id` object values and `distinct` dot-notation parameters are now validated to only contain alphanumeric characters and underscores, preventing SQL injection via the `:raw` interpolation used
GHSA
Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
ghsa·2026-03-24
CVE-2026-33539 [HIGH] CWE-89 Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
### Impact
An attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate `$group` pipeline stage or the `distinct` operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access.
Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected.
### Patches
Field names in the aggregate `$group._id` object values and `distinct` dot-notation parameters are now validated to only contain alphanumeric characters and underscores, preventing SQL injection via the `:raw` interpolation used
No detection rules found.
No public exploits indexed.
https://github.com/parse-community/parse-server/commit/03249f9bf5b8783c8b848f84dab791ff0b761b8chttps://github.com/parse-community/parse-server/commit/bdddab5f8b61a40cb8fc62dd895887bdd2f3838ehttps://github.com/parse-community/parse-server/pull/10272https://github.com/parse-community/parse-server/pull/10273https://github.com/parse-community/parse-server/security/advisories/GHSA-p2w6-rmh7-w8q3
2026-03-24
Published