Read the docs
TI-2026-44053 Aliases CVE-2026-61448GHSA-p6c5-mjgj-m4rmGHSA-r899-h629-j84r

Parse Server 9.0.0 Stored XSS via malformed Content-Type

Priority LOW 11CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-434.

Summary

Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0-alpha.2 and <= 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid type/subtype media type (e.g., 'image', 'image/', or 'image//svg+xml') bypasses the fileUpload.fileExtensions blocklist and is stored unchanged. On storage adapters that persist and serve the uploaded Content-Type (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed value and falls back to MIME-sniffing; a file whose body begins with HTML is rendered as HTML, executing embedded script in the application's origin against other users who open the file URL. The default GridFS storage adapter is not affected. Fixed in 9.10.0-alpha.2 and 8.6.84.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00415 36th percentileScored 2026-11-07
Fix Fixed parse-server (parse-community): 9.10.0-alpha.2, 8.6.84parse-server (npm): 9.10.0-alpha.2, 8.6.84

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
parse-communityparse-server9.0.0 to before 9.10.0-alpha.29.10.0-alpha.2Patch availableCNA
parse-communityparse-serverbefore 8.6.848.6.84Patch availableCNA
—parse-server (npm)9.0.0 to before 9.10.0-alpha.29.10.0-alpha.2Patch availableGHSA-r899-h629-j84r
—parse-server (npm)before 8.6.848.6.84Patch availableGHSA-r899-h629-j84r
  • parse-server Vendorparse-community Affected 9.0.0 to before 9.10.0-alpha.2 Fixed in 9.10.0-alpha.2 Patch available CNA
  • parse-server Vendorparse-community Affected before 8.6.84 Fixed in 8.6.84 Patch available CNA
  • parse-server (npm) Vendor— Affected 9.0.0 to before 9.10.0-alpha.2 Fixed in 9.10.0-alpha.2 Patch available GHSA-r899-h629-j84r
  • parse-server (npm) Vendor— Affected before 8.6.84 Fixed in 8.6.84 Patch available GHSA-r899-h629-j84r

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:*——parse-community
  • cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:* Versions — — ·parse-community

Remediation

  • Fix · CNA parse-server (parse-community) Fixed in 9.10.0-alpha.2
  • Fix · CNA parse-server (parse-community) Fixed in 8.6.84
  • Fix · GHSA-r899-h629-j84r parse-server (npm) Fixed in 9.10.0-alpha.2 Advisory →
  • Fix · GHSA-r899-h629-j84r parse-server (npm) Fixed in 8.6.84 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61448
  2. 2026-10-03 Alias added: GHSA-p6c5-mjgj-m4rm
  3. 2026-10-29 Alias added: GHSA-r899-h629-j84r
  4. 2026-10-29 Fix available: npm/[email protected], npm/[email protected] · GHSA-r899-h629-j84r
  5. 2026-10-29 CVSS score added · GHSA-r899-h629-j84r
  6. 2026-10-29 Weakness changed · GHSA-r899-h629-j84r
  7. 2026-10-29 3 new references · GHSA-r899-h629-j84r

References

Advisory 2

Other 1

  • TI-2022-08574 Command Injection in Parse server CVSS 3.1CRITICAL 10.0
  • TI-2024-18136 Parse Server literalizeRegexPart SQL Injection CVSS 3.1CRITICAL 10.0
  • TI-2022-18768 Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser CVSS 3.1CRITICAL 9.8
  • TI-2024-31550 Parse Server's custom object ID allows to acquire role privileges CVSS 3.1HIGH 8.1
  • TI-2025-35510 parse is a package designed to parse JavaScript SDK. CVSS 3.1MEDIUM 6.5
  • TI-2024-26265 ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
See all 158 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences