CVE-2024-27298: SQL Injection in parse-server
Summary
CVE-2024-27298: ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection. Affects parse-server across 2 version ranges.
< 6.5.0
>= 7.0.0-alpha.1, < 7.0.0-alpha.20
Fixed in 6.5.0 or 7.0.0-alpha.20, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2024-27298 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that allows developers to build scalable and flexible applications. It provides a RESTful API and supports various databases, including PostgreSQL. This vulnerability affects Parse Server when configured to use PostgreSQL.
Vulnerability Detail
The vulnerability allows for SQL injection attacks in Parse Server when using PostgreSQL as the database. An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation. The vulnerability has been assigned a CVSS score of 10.0, indicating its critical severity.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.5.06.5.0npm install parse-server@6.5.0 -
>= 7.0.0-alpha.1, < 7.0.0-alpha.207.0.0-alpha.20npm install parse-server@7.0.0-alpha.20
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is crucial to update Parse Server to the fixed version as soon as possible.
Conclusion
The SQL injection vulnerability in Parse Server can have severe consequences, including unauthorized access and data manipulation. It is crucial to update Parse Server to the fixed version (6.5.0 or later) to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for parse-server →
FAQ
Parse Server is an open-source backend framework for building scalable applications.
SQL injection is a code injection technique where an attacker can insert malicious SQL statements into an application's database query. This can lead to unauthorized access, data leakage, or data manipulation.
This vulnerability allows for SQL injection attacks in Parse Server, potentially leading to unauthorized access, data leakage, or data manipulation.
To fix this vulnerability, update Parse Server to version 6.5.0 or later.
There are no known workarounds for this vulnerability. Updating Parse Server to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
