CVE-2026-33539: Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter
Impact
An attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access.
Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected.
Patches
Field names in the aggregate $group.id object values and distinct dot-notation parameters are now validated to only contain alphanumeric characters and underscores, preventing SQL injection via the :raw interpolation used in the PostgreSQL storage adapter.
Workarounds
No workaround. Upgrade to a patched version.
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-alpha.53.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33539?
CVE-2026-33539 is classified as a critical vulnerability due to its potential for SQL injection and arbitrary code execution.
How do I fix CVE-2026-33539?
To fix CVE-2026-33539, upgrade the Parse Server (PostgreSQL adapter) to version 8.6.59 or version 9.6.0-alpha.53 or later.
Who is affected by CVE-2026-33539?
CVE-2026-33539 affects users of Parse Server with the PostgreSQL adapter versions lower than 8.6.59 and between 9.0.0 and 9.6.0-alpha.53.
What are the exploit conditions for CVE-2026-33539?
An attacker must have master key access to exploit CVE-2026-33539 and inject malicious SQL through field name parameters.
What type of vulnerability is CVE-2026-33539?
CVE-2026-33539 is an SQL injection vulnerability that enables attackers to execute arbitrary SQL statements.