CVE-2026-33539: Parse Server SQL Injection Vulnerability via Aggregate and Distinct Field Names
Summary
CVE-2026-33539: Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter. Affects parse across 2 version ranges.
< 8.6.59
>= 9.0.0, < 9.6.0
Fixed in 8.6.59 or 9.6.0, depending on the release line you run. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2026-33539 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend platform that allows developers to deploy applications on any infrastructure capable of running Node.js. It provides a robust set of features for building applications, including data storage, user authentication, and real-time notifications. However, deployments using the PostgreSQL adapter are vulnerable to SQL injection attacks, which can lead to unauthorized access to the database.
Vulnerability Detail
The vulnerability arises from improper handling of field name parameters in the aggregate $group pipeline stage and the distinct operation within the PostgreSQL adapter of Parse Server. An attacker with master key access can inject SQL metacharacters into these parameters, allowing them to execute arbitrary SQL statements on the PostgreSQL database. This can escalate privileges from a Parse Server application-level administrator to PostgreSQL database-level access, posing a significant security risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.6.598.6.59 -
>= 9.0.0, < 9.6.09.6.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, restrict access to the master key and ensure that only trusted users have access to it. Additionally, consider using MongoDB instead of PostgreSQL for deployments, as this vulnerability does not affect MongoDB.
Conclusion
The CVE-2026-33539 vulnerability in Parse Server poses a significant risk to applications using the PostgreSQL adapter. It is crucial to update to the latest patched versions to mitigate this risk and ensure the security of your database.
See every vulnerability recorded for parse →
FAQ
CVE-2026-33539 is a vulnerability in Parse Server that allows SQL injection through aggregate and distinct field names in the PostgreSQL adapter.
Only Parse Server deployments using the PostgreSQL adapter are affected. MongoDB deployments are not impacted.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
An attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database, leading to privilege escalation and potential data breaches.
Restrict access to the master key and consider switching to MongoDB as a temporary measure until you can update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
