PT-2026-24760 · Bitnami+4 · Parse+1

Restriction · Published 2026-03-11 · Updated 2026-03-13 · CVE-2026-31871

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.5 and versions prior to 8.6.31

Description Parse Server, a backend deployable on Node.js infrastructures, contains a SQL injection issue in the PostgreSQL storage adapter. This occurs when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). The sub-key name is directly inserted into SQL string literals without proper escaping. An attacker capable of sending write requests to the Parse Server REST API can inject arbitrary SQL code through a manipulated sub-key name containing single quotes. This could lead to command execution or data retrieval from the database, bypassing CLPs and ACLs. The issue affects only deployments utilizing PostgreSQL. The fix involves escaping single quotes in the sub-key name before interpolation into the SQL query. The vulnerable operation involves the use of the REST API. The vulnerable parameter is the sub-key name within the dot notation (e.g., stats.'evil').

Recommendations Versions prior to 9.6.0-alpha.5 should be updated to version 9.6.0-alpha.5 or later. Versions prior to 8.6.31 should be updated to version 8.6.31 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-PARSE-2026-31871

CVE-2026-31871

GHSA-GQPP-XGVH-9H7H

Affected Products

Parse

Parse Server

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31871.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-gqpp-xgvh-9h7h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31871 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31871 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-31871 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gqpp-xgvh-9h7h · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.31 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.5 · Note
• https://twitter.com/CVEnew/status/2031992394305188093 · Twitter Post
• https://twitter.com/dailycve/status/2031915417652924646 · Twitter Post
• https://twitter.com/0dayPublishing/status/2031798309761761479 · Twitter Post