Parse Server, an open‑source Node.js backend, had a stored XSS flaw before version 9.5.2‑alpha.4 and 8.6.17. Emitted SVG files containing JavaScript were served with an image/svg+xml content type and no protective headers. A browser would execute the script in the Parse Server origin context. An attacker who could authenticate could upload a crafted SVG, then use the injected script to read session tokens from localStorage and perform an account takeover. The weakness corresponds to CWE‑79, reflecting a vulnerability in input validation that permits XSS.

All Parse Server deployments built with parse-community:parse-server on node.js that had file upload enabled for authenticated users are affected. Versions prior to 9.5.2‑alpha.4 and 8.6.17 lack the mitigation; updating to 9.5.2‑alpha.4 or 8.6.17 removes the vulnerability. The default fileExtensions setting blocks HTML extensions but does not block SVG, which permits the attack vector.

The flaw carries a CVSS score of 8.3, indicating high severity, while the EPSS score is less than 1%, suggesting a low current exploitation probability. It is not listed in the CISA KEV catalog. Exploitation requires an authenticated session to upload the file, but no additional privilege escalation or network-level access is needed. Once a malicious SVG is served inline, the browser will run the injected JavaScript, enabling theft of credentials and session hijacking.