CVE-2026-33539
HIGHParse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter
Title source: cnaDescription
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-alpha.53.
Scores
CVSS v3
7.2
EPSS
0.0006
EPSS Percentile
20.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (4)
npm/parse-server
9.0.0 - 9.6.0-alpha.53npm
parse-community/parse-server
< 8.6.59
parse-community/parse-server
>= 9.0.0, < 9.6.0-alpha.53
parseplatform/parse-server
9.6.0 alpha1 (47 CPE variants)
Published
Mar 24, 2026
Tracked Since
Mar 25, 2026