PT-2026-24825 · Bitnami+4 · Parse+1

0Xkakash1 · Published 2026-03-11 · Updated 2026-03-13 · CVE-2026-32234

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.10 Parse Server versions prior to 8.6.36

Description Parse Server is an open-source backend deployable on infrastructures running Node.js. An attacker with access to the master key can inject malicious SQL code through crafted field names used in query constraints when Parse Server is configured with PostgreSQL. The field name within a $regex query operator is passed to PostgreSQL using unparameterized string interpolation, enabling manipulation of the SQL query. This SQL injection bypasses Parse Server's abstraction layer and operates directly at the database level. The issue affects deployments utilizing PostgreSQL. The API endpoint is not explicitly mentioned. The vulnerable parameter is the field name used in the $regex query operator.

Recommendations Update Parse Server to version 9.6.0-alpha.10 or later. Update Parse Server to version 8.6.36 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-PARSE-2026-32234

CVE-2026-32234

GHSA-C442-97QW-J6C6

Affected Products

Parse

Parse Server

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32234.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-c442-97qw-j6c6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32234 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32234 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2026-32234 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c442-97qw-j6c6 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.10 · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.36 · Note
• https://twitter.com/CVEnew/status/2031867662096052227 · Twitter Post
• https://twitter.com/dailycve/status/2032239328395510106 · Twitter Post