Security Advisories · parse-community/parse-server · GitHub

Security Advisories

View known security vulnerabilities and report new vulnerabilities privately to maintainers.

Report a vulnerability

Schema poisoning via prototype pollution in deep copy
GHSA-9ccr-fpp6-78qf published Mar 16, 2026 by mtrezza

Moderate
Protected fields bypass via LiveQuery subscription WHERE clause
GHSA-j7mm-f4rv-6q6q published Mar 10, 2026 by mtrezza

Moderate
SQL injection via query field name when using PostgreSQL
GHSA-c442-97qw-j6c6 published Mar 11, 2026 by mtrezza

Moderate
Stored XSS via file upload of HTML-renderable file types
GHSA-v5hf-f4c3-m5rv published Mar 10, 2026 by mtrezza

Moderate
SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
GHSA-gqpp-xgvh-9h7h published Mar 10, 2026 by mtrezza

Critical
SQL injection via `Increment` operation on nested object field in PostgreSQL
GHSA-q3vj-96h2-gwvg published Mar 10, 2026 by mtrezza

Critical
Protected fields bypass via dot-notation in query and sort
GHSA-r2m8-pxm9-9c4g published Mar 10, 2026 by mtrezza

High
SQL injection via dot-notation field name in PostgreSQL
GHSA-qpr4-jrj4-6f27 published Mar 10, 2026 by mtrezza

Critical
Denial of service via unindexed database query for unconfigured auth providers
GHSA-g4cf-xj29-wqqr published Mar 21, 2026 by mtrezza

High
MFA recovery codes not consumed after use
GHSA-4hf6-3x24-c9m8 published Mar 10, 2026 by mtrezza

High