# CVE-2026-30948: parse-server XSS — Fix Available

📦 npm

Not in CISA KEV

# CVE-2026-30948 — parse-server

CVE-2026-30948 is a Cross-site Scripting (XSS) vulnerability in parse-server. A fix is available for parse-server — see the affected versions and patch details below.

Parse Server has stored cross-site scripting (XSS) via SVG file upload

Also known asBIT-parse-2026-30948[GHSA-hcj7-6gxh-24ww](/vulnerability/GHSA-hcj7-6gxh-24ww)

Published

Mar 10, 2026

Updated

Oct 28, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Nov 2, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### No confirmed exploitation observed yet

-   CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-30948.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.2%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs13th percentile — riskier than 13% of all scored CVEsHighest risk

0.00%0.27%0.53%0.80%0.0%0.2%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

62other npm packages depend on this — each one inherits the vulnerability until it's patched upstream

`parse-server`npm

82Kdownloads / week

## Description

#### Impact

A stored cross-site scripting (XSS) vulnerability allows any authenticated user to upload an SVG file containing JavaScript. The file is served inline with `Content-Type: image/svg+xml` and without protective headers, causing the browser to execute embedded scripts in the Parse Server origin. This can be exploited to steal session tokens from `localStorage` and achieve account takeover.

The default `fileExtensions` option blocks HTML file extensions but does not block SVG, which is a well-known XSS vector. All Parse Server deployments where file upload is enabled for authenticated users (the default) are affected.

#### Patches

The fix adds `svg` (case-insensitive) to the default file extension denylist. The default regex changes from `^(?![xXsS]?[hH][tT][mM][lL]?$)` to `^(?!([xXsS]?[hH][tT][mM][lL]?|[sS][vV][gG])$)`.

#### Workarounds

Configure the `fileExtensions` option to explicitly block SVG uploads:

```
{
  fileUpload: {
    fileExtensions: ['^(?!([xXsS]?[hH][tT][mM][lL]?|[sS][vV][gG])$)']
  }
}
```

#### References

-   GitHub security advisory: [https://github.com/parse-community/parse-server/security/advisories/GHSA-hcj7-6gxh-24ww](https://github.com/parse-community/parse-server/security/advisories/GHSA-hcj7-6gxh-24ww)
-   Fix Parse Server 9: [https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.4](https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.4)
-   Fix Parse Server 8: [https://github.com/parse-community/parse-server/releases/tag/8.6.17](https://github.com/parse-community/parse-server/releases/tag/8.6.17)

## Affected Packages

2 total 2 fixed

Ecosystem

Package

Vulnerable range

Fix

📦npm

`parse-server` 

≥ 9.0.0&&< 9.5.2-alpha.4

9.5.2-alpha.4`npm install parse-server@9.5.2-alpha.4`

📦npm

`parse-server` 

all versions

8.6.17`npm install parse-server@8.6.17`

## Affected Products

1 product · 5 configurations

Application

`parse-server`parseplatform

≥ 9.0.0 && < 9.5.2

1 version

9.5.2

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for parse-server, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update parse-server to 9.5.2-alpha.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-30948 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
    

## Frequently Asked Questions

\### Impact A stored cross-site scripting (XSS) vulnerability allows any authenticated user to upload an SVG file containing JavaScript. The file is served inline with \`Content-Type: image/svg+xml\` and without protective headers, causing the browser to execute embedded scripts in the Parse Server origin. This can be exploited to steal session tokens from \`localStorage\` and achieve account takeover. The default \`fileExtensions\` option blocks HTML file extensions but does not block SVG, which is a well-known XSS vector. All Parse Server deployments where file upload is enabled for authenticated

O3 Security · Impact-Aware SCA

### Is CVE-2026-30948 in your dependencies?

Find it across npm, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)