Executive brief
Parse Server is a backend-as-a-service platform that manages application data storage. A SQL injection flaw in the PostgreSQL storage adapter allows attackers to inject arbitrary SQL code through the Increment operation on nested fields, enabling unauthorized database access and data exfiltration while bypassing security controls. This vulnerability affects only PostgreSQL deployments; MongoDB is unaffected.
Technical details
The vulnerability is a SQL injection (CWE-89) in the PostgreSQL storage adapter's Increment operation handler. When processing Increment operations on nested object fields using dot notation (e.g., stats.counter), the amount value is interpolated directly into the SQL query without parameterization or type validation. An attacker with write access to the Parse Server REST API can craft a malicious amount parameter containing arbitrary SQL subqueries to read any data from the database, bypassing Class-Level Permissions (CLPs) and Access Control Lists (ACLs). Attack vector is network-based with no authentication or user interaction required. The fix (available in Parse Server 8.6.29 and 9.6.0-alpha.3) adds type validation and parameterizes the value to prevent SQL injection.
Affected products
- Parse Community Parse Server all versions before 8.6.29, and 9.0.0-alpha.1 to 9.6.0-alpha.3 (PostgreSQL adapter only)
Timeline
- 2026-03-11: disclosed: Security advisory published
- 2026-03-11: patched: Parse Server 8.6.29 and 9.6.0-alpha.3 released with fix