CVE-2026-31856: 
JavaScript vulnerability analysis and mitigation

CVE-2026-31856 is a critical SQL injection vulnerability in Parse Server's PostgreSQL storage adapter, titled "SQL injection via Increment operation on nested object field in PostgreSQL." It affects Parse Server (npm) versions >= 9.0.0-alpha.1 and < 9.6.0-alpha.3, as well as all versions < 8.6.29. The vulnerability was published on March 10, 2026, and disclosed via GitHub Advisory GHSA-q3vj-96h2-gwvg. It carries a CVSS v4 base score of 9.3 (Critical) and a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Github Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). When Parse Server processes an Increment operation on a nested object field using dot notation (e.g., stats.counter) via the REST API, the amount value is interpolated directly into the generated PostgreSQL SQL query without parameterization or type validation. This allows an attacker to inject arbitrary SQL subqueries into the query, bypassing Class-Level Permissions (CLPs) and Access Control Lists (ACLs). The vulnerability is specific to the PostgreSQL storage adapter; MongoDB deployments are not affected. The fix, applied in patched versions, adds type validation to reject non-numeric values and uses parameterized queries instead of string interpolation (GitHub Advisory, Github Advisory).

Successful exploitation allows an unauthenticated attacker with the ability to send write requests to the Parse Server REST API to inject arbitrary SQL subqueries, enabling unauthorized read access to any data stored in the PostgreSQL database. This completely bypasses application-level access controls (CLPs and ACLs), exposing sensitive user data, credentials, and application data to unauthorized parties. While the CVSS v4 score reflects no direct availability impact, the confidentiality and integrity of the vulnerable system are rated High, indicating significant risk of data exfiltration and potential data manipulation (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Github Advisory). The vulnerability requires no authentication, no user interaction, and no special privileges — only the ability to send write requests to the Parse Server REST API, making it trivially exploitable if the API is internet-facing. The EPSS score is approximately 0.042% (13th percentile), indicating a currently low but non-negligible probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Parse Server instances using PostgreSQL as the storage backend (e.g., via Shodan, Censys, or application fingerprinting). Confirm the server version is < 8.6.29 or >= 9.0.0-alpha.1 and < 9.6.0-alpha.3.
2. Identify REST API endpoint: Locate the Parse Server REST API endpoint (typically /parse/classes/<ClassName>) that accepts write operations (PUT/POST requests).
3. Craft malicious Increment payload: Construct a REST API request that performs an Increment operation on a nested object field using dot notation (e.g., stats.counter), substituting the amount value with a malicious SQL subquery instead of a numeric value. Example payload body:

{
  "stats.counter": { "__op": "Increment", "amount": "1,(SELECT pg_sleep(5))--" }
}

4. Send the request: Submit the crafted PUT/POST request to the Parse Server REST API. The unparameterized amount value is interpolated directly into the SQL query executed against PostgreSQL.
5. Extract data: Refine the injected subquery to exfiltrate arbitrary data from any table in the PostgreSQL database, bypassing CLPs and ACLs (e.g., using error-based or time-based blind SQL injection techniques to read user credentials, session tokens, or other sensitive records) (GitHub Advisory).

• Network: Unusual or malformed PUT/POST requests to Parse Server REST API endpoints (e.g., /parse/classes/) containing __op: Increment with non-numeric or SQL-like amount values; unexpected outbound connections from the Parse Server host to external IPs.
• Logs: Parse Server access logs showing REST API write requests with Increment operations on nested dot-notation fields (e.g., stats.counter) where the amount field contains SQL syntax, quotes, parentheses, or keywords such as SELECT, UNION, pg_sleep, or --; PostgreSQL query logs showing unexpected subqueries or syntax errors originating from Parse Server.
• Database: Unexpected or anomalous SQL queries in PostgreSQL logs involving Increment-related UPDATE statements with embedded subqueries; unusual data access patterns across tables not normally queried by the application.

Parse Community has released patched versions to address this vulnerability: Parse Server 8.x users should upgrade to 8.6.29, and Parse Server 9.x users should upgrade to 9.6.0-alpha.3 or later. There is no known configuration-based workaround — upgrading is the only remediation. As an interim measure, operators should restrict network-level access to the Parse Server REST API to trusted sources only, and conduct a database audit to check for signs of unauthorized data access (GitHub Advisory, Release 8.6.29, Release 9.6.0-alpha.3).