CVE-2026-31840

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-31840
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.2 and 8.6.28, an attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters. This vulnerability only affects deployments using a PostgreSQL database. This vulnerability is fixed in 9.6.0-alpha.2 and 8.6.28.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/parse-community/parse-server/releases/tag/8.6.28 Product Release Notes
https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.2 Product Release Notes
https://github.com/parse-community/parse-server/security/advisories/GHSA-qpr4-jrj4-6f27 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:*
History

13 Mar 2026, 18:54

Type Values Removed Values Added
First Time Parseplatform
Parseplatform parse-server
CPE cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:*
Summary
  • (es) Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de 9.6.0-alpha.2 y 8.6.28, un atacante puede usar un nombre de campo con notación de puntos en combinación con el parámetro de consulta 'sort' para inyectar SQL en la base de datos PostgreSQL a través de un escape incorrecto de valores de subcampo en consultas con notación de puntos. La vulnerabilidad también puede afectar a las consultas que usan nombres de campo con notación de puntos con los parámetros de consulta 'distinct' y 'where'. Esta vulnerabilidad solo afecta a los despliegues que usan una base de datos PostgreSQL. Esta vulnerabilidad está corregida en 9.6.0-alpha.2 y 8.6.28.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
References () https://github.com/parse-community/parse-server/releases/tag/8.6.28 - () https://github.com/parse-community/parse-server/releases/tag/8.6.28 - Product, Release Notes
References () https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.2 - () https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.2 - Product, Release Notes
References () https://github.com/parse-community/parse-server/security/advisories/GHSA-qpr4-jrj4-6f27 - () https://github.com/parse-community/parse-server/security/advisories/GHSA-qpr4-jrj4-6f27 - Patch, Vendor Advisory

11 Mar 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-11 17:16

Updated : 2026-03-13 18:54

NVD link : CVE-2026-31840

Mitre link : CVE-2026-31840

CVE.ORG link : CVE-2026-31840

JSON object : View

Products Affected

parseplatform

  • parse-server
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')