CVE-2026-31840: Parse Server has a SQL injection via dot-notation field name in PostgreSQL
Impact
An attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters.
This vulnerability only affects deployments using a PostgreSQL database.
Patches
The fix escapes characters in dot-notation sub-field values that could allow a SQL breakout.
Workarounds
There is no known workaround.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-qpr4-jrj4-6f27 - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.2 - Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.28
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.2 and 8.6.28, an attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters. This vulnerability only affects deployments using a PostgreSQL database. This vulnerability is fixed in 9.6.0-alpha.2 and 8.6.28.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31840?
CVE-2026-31840 has a high severity due to the potential for SQL injection attacks allowing unauthorized database access.
How do I fix CVE-2026-31840?
To fix CVE-2026-31840, upgrade to Parse Server version 8.6.28 or 9.6.0-alpha.2.
What kind of attack can be executed using CVE-2026-31840?
CVE-2026-31840 allows an attacker to perform SQL injection by using a dot-notation field name with the sort query parameter.
Which versions of Parse Server are affected by CVE-2026-31840?
CVE-2026-31840 affects all versions of Parse Server prior to 8.6.28 and from 9.0.0 up to 9.6.0-alpha.2.
Is CVE-2026-31840 specific to any database?
Yes, CVE-2026-31840 is specifically related to SQL injection vulnerabilities in PostgreSQL databases.