SQL Injection Vulnerability in Parse Server PostgreSQL Deployments
CVE-2026-33539
What is CVE-2026-33539?
An SQL injection vulnerability exists in Parse Server before versions 8.6.59 and 9.6.0-alpha.53 that allows attackers with master key permissions to execute arbitrary SQL commands on the underlying PostgreSQL database. This exploitation occurs through the injection of SQL metacharacters into specific fields within the aggregate $group pipeline stage or distinct operations. Consequently, it can lead to privilege escalation, providing access from the application-level functionality of Parse Server’s administration to direct database-level manipulation. This issue is strictly relevant to deployments utilizing PostgreSQL, as MongoDB-based systems remain unaffected. Security patches to mitigate this vulnerability are available in the aforementioned versions.
Affected Version(s)
parse-server < 8.6.59 < 8.6.59
parse-server >= 9.0.0, < 9.6.0-alpha.53 < 9.0.0, 9.6.0-alpha.53