CVE-2026-32234: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32234 is a SQL injection vulnerability in Parse Server, an open-source Node.js backend framework, affecting deployments configured with PostgreSQL as the database. An attacker with access to the master key can inject malicious SQL via crafted field names in query constraints, specifically through the $regex query operator, which passes field names to PostgreSQL using unparameterized string interpolation. Affected versions include all Parse Server releases prior to 8.6.36 (8.x branch) and versions 9.0.0 through 9.6.0-alpha.9 (9.x branch). The vulnerability was published on March 11, 2026, with fixes released the same day. It carries a CVSS v4.0 base score of 5.1 (Medium) and a CVSS v3.1 base score of 4.7 (Medium) (GitHub Advisory, Github Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where field names supplied in $regex query operator constraints are concatenated into SQL statements via unparameterized string interpolation rather than using parameterized queries or proper SQL identifier escaping. This allows an attacker to break out of the intended query structure and inject arbitrary SQL that executes directly against the PostgreSQL database, entirely bypassing Parse Server's abstraction layer and its access controls. Exploitation requires possession of the Parse Server master key, which is a high-privilege credential; however, once obtained, the attacker can craft a query request with a malicious field name to manipulate the underlying SQL. The fix applies proper SQL identifier escaping to field names in the query handler and hardens field name validation to reject malicious input across all query types (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary SQL commands directly against the PostgreSQL database, bypassing all Parse Server-level security controls. This can result in unauthorized data access and exfiltration, unauthorized data modification or deletion, and partial disruption of database availability. The scope is limited to Parse Server deployments using PostgreSQL; instances using other databases (e.g., MongoDB) are not affected (Github Advisory, GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.043% (14th percentile), indicating a low near-term probability of exploitation. Exploitation is constrained by the requirement to possess the Parse Server master key, significantly limiting the attacker pool to insiders or those who have already compromised master key credentials.

1. Obtain the master key: Acquire the Parse Server master key through credential theft, insider access, misconfigured environment variables, or exposed configuration files.
2. Identify a vulnerable target: Confirm the target Parse Server instance is running a version prior to 8.6.36 or between 9.0.0 and 9.6.0-alpha.9, and is configured to use PostgreSQL as its database backend.
3. Craft a malicious query: Construct a Parse Server API query using the $regex operator with a field name containing SQL injection payload. For example, send a POST request to the Parse Server query endpoint (e.g., /1/classes/TargetClass) with a JSON body such as: {"where": {"<malicious_field_name_with_SQL>": {"$regex": ".*"}}}.
4. Inject SQL payload: The malicious field name is interpolated directly into the PostgreSQL SQL statement without escaping, causing the injected SQL to execute at the database level (e.g., extracting data from other tables, modifying records, or enumerating schema).
5. Exfiltrate or manipulate data: Use the injected SQL to read sensitive data, alter records, or perform further actions against the PostgreSQL database beyond what Parse Server's abstraction layer would normally permit (GitHub Advisory).

• Network: Unusual or unexpected API requests to Parse Server query endpoints (e.g., /1/classes/*) containing field names with SQL metacharacters (e.g., quotes, semicolons, SQL keywords like SELECT, UNION, DROP) in the where clause.
• Logs: Parse Server access logs showing queries with anomalous field names in $regex operators; PostgreSQL logs recording unexpected SQL syntax errors or unusual query patterns originating from the Parse Server database user.
• Database: Unexpected reads from system tables (e.g., pg_catalog, information_schema), unauthorized data modifications, or new database objects created by the Parse Server database account.

Parse Server has released patched versions addressing this vulnerability: 8.6.36 for the 8.x branch and 9.6.0-alpha.10 for the 9.x branch, both released on March 11, 2026. There is no known workaround; upgrading to a patched version is the only remediation. As an interim measure, organizations should ensure the master key is securely managed, access is strictly limited to authorized personnel, and suspicious database activity is monitored. Non-PostgreSQL deployments (e.g., MongoDB) are not affected (GitHub Advisory, Release 8.6.36, Release 9.6.0-alpha.10).

The vulnerability was reported by security researcher 0xkakash1 and coordinated by mtrezza from the Parse community. The advisory was published directly via GitHub Security Advisories on March 11, 2026, with patches released the same day, reflecting a responsible disclosure process. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability tracking and aggregation sites (GitHub Advisory).