Parse Server applies dot‑notation field names in query parameters such as sort, distinct, and where. The server fails to properly escape the sub‑field values when processing these dot‑notation queries against a PostgreSQL backend, allowing an attacker to inject arbitrary SQL. This flaw (CWE‑89) enables attackers to read, modify, or delete data stored in the database and is therefore a critical vulnerability that compromises confidentiality, integrity, and potentially availability of the application data.

The vulnerability is limited to Parse Server deployments that use PostgreSQL and run any release prior to 9.6.0‑alpha.2 or 8.6.28. Both the 8.x and 9.x major series are affected. Deployments that have upgraded to the patched releases are not impacted. The affected products are provided by parse-community:parse-server and are listed in the CPE data as parse-server:* and parse-server:9.6.0:alpha1.

The CVSS score of 9.3 categorises this as a critical issue. The EPSS score is less than 1 %, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating a low baseline exploitation probability in the wild. However, exploitation requires only the ability to send a crafted HTTP request to the Parse Server API, and authentication is not explicitly required by the description. Thus the attack vector is remote over the web API, and the potential impact is high due to the ability to execute arbitrary SQL statements against the database.