Security: parse-community/parse-server
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
SQL injection via aggregate and distinct field names in PostgreSQL adapterGHSA-p2w6-rmh7-w8q3 published
Mar 21, 2026 by mtrezzaHigh -
Query condition depth bypass via pre-validation transform pipelineGHSA-9fjp-q3c4-6w3j published
Mar 20, 2026 by mtrezzaHigh -
LiveQuery subscription query depth bypassGHSA-6qh5-m6g3-xhq6 published
Mar 20, 2026 by mtrezzaHigh -
Session update endpoint allows overwriting server-generated session fieldsGHSA-jc39-686j-wp6q published
Mar 21, 2026 by mtrezzaModerate -
Protected field change detection oracle via LiveQuery watch parameterGHSA-qpc3-fg4j-8hgm published
Mar 20, 2026 by mtrezzaModerate -
LiveQuery bypasses CLP pointer permission enforcementGHSA-fph2-r4qg-9576 published
Mar 20, 2026 by mtrezzaHigh -
Auth provider validation bypass on login via partial authDataGHSA-pfj7-wv7c-22pr published
Mar 19, 2026 by mtrezzaHigh -
Server crash via deeply nested query condition operatorsGHSA-9xp9-j92r-p88v published
Mar 16, 2026 by mtrezzaHigh -
Empty authData bypasses credential requirement on signupGHSA-wjqw-r9x4-j59v published
Mar 16, 2026 by mtrezzaModerate -
Stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entriesGHSA-42ph-pf9q-cr72 published
Mar 13, 2026 by mtrezzaHigh