CVE-2025-68115: Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables
Impact
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password reset and email verification HTML pages.
Patches
The patch escapes user controlled values that are inserted into the HTML pages.
Workarounds
None.
Resources
- https://github.com/parse-community/parse-server/security/advisories/GHSA-jhgf-2h8h-ggxv - https://github.com/parse-community/parse-server/pull/9985 - https://github.com/parse-community/parse-server/pull/9986
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 8.6.1 and 9.1.0-alpha.3, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password reset and email verification HTML pages. The patch, available in versions 8.6.1 and 9.1.0-alpha.3, escapes user controlled values that are inserted into the HTML pages. No known workarounds are available.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68115?
CVE-2025-68115 has been classified as a moderate severity vulnerability due to the potential for reflected cross-site scripting attacks.
How do I fix CVE-2025-68115?
To fix CVE-2025-68115, upgrade Parse Server to version 8.6.1 or later, or to version 9.1.0-alpha.3 or later.
What does CVE-2025-68115 affect?
CVE-2025-68115 affects Parse Server versions prior to 8.6.1 and 9.1.0-alpha.3, specifically the password reset and email verification HTML pages.
What types of attacks can CVE-2025-68115 enable?
CVE-2025-68115 can enable reflected cross-site scripting (XSS) attacks, which may lead to unauthorized actions on behalf of users.
Is CVE-2025-68115 a persistent vulnerability?
CVE-2025-68115 is classified as a reflected XSS vulnerability, which means it does not persistently compromise the application itself.