CVE-2026-33539

HIGH

Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter

Title source: cna
STIX 2.1

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-alpha.53.

References (5)

Core 5

Scores

CVSS v3 7.2
EPSS 0.0045
EPSS Percentile 35.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (4)
npm/parse-server 9.0.0 - 9.6.0-alpha.53npm
parse-community/parse-server < 8.6.59
parse-community/parse-server >= 9.0.0, < 9.6.0-alpha.53
parseplatform/parse-server 9.6.0 alpha1 (47 CPE variants)
Published Mar 24, 2026
Tracked Since Mar 25, 2026