{"id":"CVE-2026-33539","aliases":["BIT-parse-2026-33539","GHSA-p2w6-rmh7-w8q3"],"url":"https://o3.security/vulnerability/CVE-2026-33539","summary":"Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter","details":"### Impact\n\nAn attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate `$group` pipeline stage or the `distinct` operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access.\n\nOnly Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected.\n\n### Patches\n\nField names in the aggregate `$group._id` object values and `distinct` dot-notation parameters are now validated to only contain alphanumeric characters and underscores, preventing SQL injection via the `:raw` interpolation used in the PostgreSQL storage adapter.\n\n### Workarounds\n\nNo workaround. Upgrade to a patched version.","published":"2026-03-24T18:26:56.046Z","modified":"2026-08-12T03:51:33.783076503Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"parse-server","fixedVersion":"9.6.0-alpha.53"},{"ecosystem":"npm","name":"parse-server","fixedVersion":"8.6.59"}],"fix":{"url":"https://github.com/parse-community/parse-server/commit/03249f9bf5b8783c8b848f84dab791ff0b761b8c","label":"parse-community/parse-server@03249f9"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33539.json"},{"type":"ADVISORY","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-p2w6-rmh7-w8q3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33539"},{"type":"FIX","url":"https://github.com/parse-community/parse-server/commit/03249f9bf5b8783c8b848f84dab791ff0b761b8c"},{"type":"FIX","url":"https://github.com/parse-community/parse-server/commit/bdddab5f8b61a40cb8fc62dd895887bdd2f3838e"},{"type":"FIX","url":"https://github.com/parse-community/parse-server/pull/10272"},{"type":"FIX","url":"https://github.com/parse-community/parse-server/pull/10273"},{"type":"PACKAGE","url":"https://github.com/parse-community/parse-server"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:33.783076503Z"}}