Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL

The SQL Injection vulnerability in Parse Server arises from the improper handling of sub-key names within PostgreSQL storage adapter’s Increment operations. Specifically, when updating nested object fields using dot notation (e.g., stats.counter), the sub-key name is directly interpolated into SQL string literals without proper escaping. This lack of sanitization enables an attacker who can send write requests to the Parse Server REST API to inject malicious SQL code. Successful exploitation could lead to unauthorized data access, modification, or deletion, potentially allowing attackers to bypass existing access controls (CLPs and ACLs) and gain full control over the database. The blast radius is significant, potentially impacting all data stored within the Parse Server instance.

Organizations utilizing Parse Server with PostgreSQL as their storage adapter are at risk, particularly those running versions prior to 9.6.0-alpha.5. Shared hosting environments where Parse Server instances are deployed alongside other applications are also at increased risk due to the potential for cross-tenant attacks.

• nodejs / server:

# Check for vulnerable Parse Server versions
ps aux | grep 'node parse-server' | grep -i '9.6.0-alpha.5'

• database (postgresql):

-- Check for suspicious SQL queries in the PostgreSQL logs
SELECT query FROM pg_stat_statements WHERE query LIKE '%'; -- Look for queries containing single quotes or unusual SQL syntax

• generic web:

# Check Parse Server API endpoints for unexpected behavior
curl -X POST -d '{"Increment":{"stats.counter":"'"}"' http://your-parse-server/ | grep -i "error"

1. 2026-03-11Disclosure

   disclosure

1. Reserviert2026-03-09
2. Veröffentlicht2026-03-11
3. Geändert2026-03-13
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-31871 is to immediately upgrade Parse Server to version 9.6.0-alpha.5 or later. If an immediate upgrade is not feasible, consider implementing stricter input validation on the server-side to sanitize sub-key names before they are incorporated into SQL queries. While not a complete solution, this can reduce the attack surface. Additionally, review and tighten access control policies (CLPs and ACLs) to limit the potential impact of a successful SQL injection attack. After upgrading, confirm the fix by attempting to trigger the vulnerable Increment operation with a crafted sub-key containing single quotes and verifying that the query fails with an error instead of executing arbitrary SQL.