Parse Server allows an attacker who holds the master key to inject arbitrary SQL via field names used in $regex query operators when the server is connected to PostgreSQL. The vulnerability stems from unparameterized string interpolation of these field names, enabling a crafted query to be executed at the database level and bypassing the standard Parse Server abstraction. Successful exploitation could read, modify or delete data stored in the PostgreSQL database, potentially causing confidentiality, integrity, and availability violations for the entire application that relies on Parse Server.

The affected product is Parse Server (parse-community:parse-server). Any deployment using PostgreSQL as its database is vulnerable if it runs a version prior to 9.6.0-alpha.10 or 8.6.36. Versions up to 9.6.0-alpha.9 and 8.6.35 are included in this scope.

The CVSS score is 5.1 (Medium), and the EPSS score is less than 1%, indicating a low likelihood of public exploitation. This vulnerability is not listed in CISA’s KEV catalog. Exploitation requires access to the master key to construct the offending query, making it an internal threat for deployments that expose the master key or allow privileged users to send custom queries.