Parse Server contains a SQL injection flaw in the PostgreSQL storage adapter that occurs when an Increment operation references a nested object field through dot notation (e.g., stats.counter). The adapter directly interpolates the sub‑key name into SQL string literals without proper escaping, allowing an attacker to inject arbitrary SQL fragments. An attacker who can send write requests to the Parse Server REST API can exploit this flaw to read sensitive data, bypass Cloud‑Level Permissions (CLPs) and Access Control Lists (ACLs), or even execute database commands that could compromise the entire PostgreSQL instance.

The vulnerability affects the parse-community:parse-server product. Versions earlier than 9.6.0‑alpha.5 and 8.6.31 contain the flaw. Only deployments that use the PostgreSQL storage adapter are impacted. The affected CPEs include parseplatform:parse-server with Node.js environments and the specific alpha releases of 9.6.0 listed in the data.

The CVSS score of 9.3 indicates a high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The flaw is not listed in the CISA KEV catalog. Attackers who can reach the Parse Server REST API and have permission to perform Increment operations on nested fields have the necessary conditions to exploit this vulnerability. Given the potential for unauthorized data access or database compromise, the risk is significant for any exposed instance.