9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31856

CVE-2026-31856: Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). The amount value is interpolated directly into the SQL query without parameterization or type validation. An attacker who can send write requests to the Parse Server REST API can inject arbitrary SQL subqueries to read any data from the database, bypassing CLPs and ACLs. MongoDB deployments are not affected. This vulnerability is fixed in 9.6.0-alpha.3 and 8.6.29.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31856

CVE-2026-31856:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0-alpha.1, < 9.6.0-alpha.3	9.6.0-alpha.3
parse-server	npm	< 8.6.29	8.6.29

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the PostgreSQL storage adapter of Parse Server. Specifically, the update method within the PostgresStorageAdapter class was identified as the source of the vulnerability. The analysis of the provided commit c92022f clearly shows the patch that addresses the issue. Before the fix, the amount for an Increment operation on a nested field was directly concatenated into the SQL query string. This is a classic SQL injection vulnerability. The patch rectifies this by adding a type check to ensure the amount is a number and then uses a parameterized query to pass the value to the database, preventing malicious SQL code from being executed. The vulnerable function, PostgresStorageAdapter.update, would be present in any runtime profile or stack trace when a vulnerable Increment operation is performed.

Vulnerable functions

PostgresStorageAdapter.update

src/Adapters/Storage/Postgres/PostgresStorageAdapter.js

The `update` function in the `PostgresStorageAdapter` class constructs an SQL query for an `Increment` operation. The `amount` value, which is user-controllable, was directly interpolated into the SQL query string without proper sanitization or parameterization. This allowed an attacker to inject arbitrary SQL by providing a malicious string in the `amount` field for a nested object update, leading to a SQL injection vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.