PT-2026-24651 · Bitnami+4 · Parse+1

Restriction · Published 2026-03-10 · Updated 2026-03-13 · CVE-2026-31840

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.2 and 8.6.28

Description Parse Server, an open-source backend deployable on Node.js infrastructures, is susceptible to SQL injection when using PostgreSQL databases. An attacker can exploit this by utilizing a dot-notation field name in conjunction with the sort query parameter. This allows for the injection of SQL code due to improper escaping of sub-field values within dot-notation queries. The issue potentially affects queries employing dot-notation field names alongside the distinct and where query parameters. The injection occurs through the use of a dot-notation field name and the sort parameter.

Recommendations Versions prior to 9.6.0-alpha.2 should be updated to 9.6.0-alpha.2 or later. Versions prior to 8.6.28 should be updated to 8.6.28 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-PARSE-2026-31840

CVE-2026-31840

GHSA-QPR4-JRJ4-6F27

Affected Products

Parse

Parse Server

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31840.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-qpr4-jrj4-6f27 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31840 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31840 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2026-31840 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qpr4-jrj4-6f27 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.2 · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.28 · Note
• https://t.me/CVEtracker/47152 · Telegram Post
• https://twitter.com/CVEnew/status/2031992409194971578 · Twitter Post
• https://twitter.com/0dayPublishing/status/2031783194358436270 · Twitter Post
• https://twitter.com/infoflowcloud/status/2031994059410034791 · Twitter Post