9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31871

CVE-2026-31871: Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.5 and 8.6.31, a SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). The sub-key name is interpolated directly into SQL string literals without escaping. An attacker who can send write requests to the Parse Server REST API can inject arbitrary SQL via a crafted sub-key name containing single quotes, potentially executing commands or reading data from the database, bypassing CLPs and ACLs. Only Postgres deployments are affected. This vulnerability is fixed in 9.6.0-alpha.5 and 8.6.31.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31871

CVE-2026-31871:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0-alpha.1, < 9.6.0-alpha.5	9.6.0-alpha.5
parse-server	npm	< 8.6.31	8.6.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the PostgresStorageAdapter.js file, specifically within the logic that handles Increment operations for the PostgreSQL database. The analysis of the patch aa0de68 reveals that the root cause is improper SQL query construction. When a user requests to increment a nested field (e.g., {"stats.counter' --": {"__op":"Increment","amount":1}}), the sub-key (counter' --) is used to build a SQL fragment. The original code directly embedded this sub-key into a SQL string, failing to escape single quotes. This allows an attacker to terminate the string and inject arbitrary SQL commands. The primary vulnerable function is PostgresStorageAdapter.update, which contains this flawed logic. The helper function transformDotFieldToComponents is also identified as it's part of the execution flow for handling the malicious, user-provided field name.

Vulnerable functions

PostgresStorageAdapter.update

src/Adapters/Storage/Postgres/PostgresStorageAdapter.js

The `update` function in the `PostgresStorageAdapter` is vulnerable to SQL injection. When handling an 'Increment' operation on a nested object field (e.g., 'stats.counter'), the function constructs a raw SQL query. The sub-key part of the field path (the part after the dot) is directly concatenated into the SQL string without proper escaping. An attacker can craft a sub-key containing a single quote to break out of the SQL string literal and inject arbitrary SQL commands, leading to unauthorized database access and execution.

transformDotFieldToComponents

src/Adapters/Storage/Postgres/PostgresStorageAdapter.js

This helper function is involved in processing the dot-notation field names that can be controlled by a user. While the patch primarily refactors the escaping to use a centralized `escapeSqlString` function, the function's role in handling potentially malicious input makes it a relevant indicator in a runtime profile when the vulnerability is triggered. It processes the field name before it's used in the vulnerable SQL query construction within the `update` method.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.