🛡️ CVE-2026-31840 — parse

🔴 CVSS 9.5 — Critical ✅ No Known Exploit OSV
9.5
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Parse Server: SQL injection via dot-notation field name in PostgreSQL

Impact

An attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters.

This vulnerability only affects deployments using a PostgreSQL database.

Patches

The fix escapes characters in dot-notation sub-field values that could allow a SQL breakout.

Workarounds

There is no known workaround.

References

  • GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-qpr4-jrj4-6f27
  • Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.2
  • Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.28

Affected software

CVE-2026-31840 is recorded against 2 packages.

  • parse
  • parse-server

Timeline and source

Published on 13 March 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
github.com (Web)
github.com (Web)
nvd.nist.gov (Web)

Details

Severity CRITICAL
CVSS Score 9.5
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2026-03-13
Updated 2026-08-12
Modified 2026-03-13
Fix URL N/A

Affected Packages

Software From version Fixed in
parse — —
parse-server — —

Similar Threats

Exploit Protection

Are you running parse?

CVE-2026-31840 carries CVSS 9.5 Critical rating. BotEraser checks your installation against this and other known CVE records, and blocks IPs associated with exploit activity.

Check My Site For CVE-2026-31840 →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.