9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31840

CVE-2026-31840: Parse Server has a SQL injection via dot-notation field name in PostgreSQL

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.2 and 8.6.28, an attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters. This vulnerability only affects deployments using a PostgreSQL database. This vulnerability is fixed in 9.6.0-alpha.2 and 8.6.28.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31840

CVE-2026-31840:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.6.0-alpha.2	9.6.0-alpha.2
parse-server	npm	< 8.6.28	8.6.28

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a SQL injection in Parse Server's PostgreSQL adapter. The root cause is improper escaping of sub-field values in dot-notation queries. The patch is located in the transformDotFieldToComponents function within src/Adapters/Storage/Postgres/PostgresStorageAdapter.js. This function is responsible for splitting dot-notation field names into components for use in SQL queries. The patch adds escaping for single and double quotes to prevent SQL injection. The commit 83f38fa clearly shows the vulnerable code being replaced with the patched version. The vulnerability can be triggered via the sort, distinct, and where query parameters when using a PostgreSQL database. The provided tests in the commit confirm that the order parameter (which maps to sort) was a valid vector for this attack.

Vulnerable functions

transformDotFieldToComponents

src/Adapters/Storage/Postgres/PostgresStorageAdapter.js

The function `transformDotFieldToComponents` is responsible for processing dot-notation field names used in queries. Before the patch, it failed to properly escape single and double quotes in the sub-field components. An attacker could provide a specially crafted field name in the `sort`, `distinct`, or `where` query parameters, which would be processed by this function. The lack of escaping allowed for a SQL injection vulnerability, enabling the attacker to execute arbitrary SQL commands on the PostgreSQL database.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.