CVE-2026-31840: Parse Server: SQL injection via dot-notation field name in PostgreSQL
(updated )
An attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters.
This vulnerability only affects deployments using a PostgreSQL database.
References
- github.com/advisories/GHSA-qpr4-jrj4-6f27
- github.com/parse-community/parse-server
- github.com/parse-community/parse-server/releases/tag/8.6.28
- github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.2
- github.com/parse-community/parse-server/security/advisories/GHSA-qpr4-jrj4-6f27
- nvd.nist.gov/vuln/detail/CVE-2026-31840
Code Behaviors & Features
Detect and mitigate CVE-2026-31840 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →