Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-avfq-2nfn-fkdw
Vulnerability ID VCID-avfq-2nfn-fkdw
Aliases CVE-2024-27298
GHSA-6927-3vr9-fxf2
Summary ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection ### Impact This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. ### Patches The algorithm to detect SQL injection has been improved. ### Workarounds None. ### References - https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2 - https://github.com/parse-community/parse-server/releases/tag/6.5.0 (fixed in Parse Server 6) - https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20 (fixed in Parse Server 7 alpha release) ### Credits - Mikhail Shcherbakov (https://twitter.com/yu5k3) working with Trend Micro Zero Day Initiative (finder) - Ehsan Persania (remediation developer) - Manuel Trezza (coordinator)
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00313 https://api.first.org/data/v1/epss?cve=CVE-2024-27298
epss 0.00313 https://api.first.org/data/v1/epss?cve=CVE-2024-27298
epss 0.00313 https://api.first.org/data/v1/epss?cve=CVE-2024-27298
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-6927-3vr9-fxf2
cvssv3.1 10.0 https://github.com/parse-community/parse-server
generic_textual CRITICAL https://github.com/parse-community/parse-server
cvssv3.1 10 https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504
cvssv3.1 10.0 https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504
generic_textual CRITICAL https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504
ssvc Track https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504
cvssv3.1 10 https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833
cvssv3.1 10.0 https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833
generic_textual CRITICAL https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833
ssvc Track https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833
cvssv3.1 10 https://github.com/parse-community/parse-server/releases/tag/6.5.0
cvssv3.1 10.0 https://github.com/parse-community/parse-server/releases/tag/6.5.0
generic_textual CRITICAL https://github.com/parse-community/parse-server/releases/tag/6.5.0
ssvc Track https://github.com/parse-community/parse-server/releases/tag/6.5.0
cvssv3.1 10 https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20
cvssv3.1 10.0 https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20
generic_textual CRITICAL https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20
ssvc Track https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20
cvssv3.1 10 https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2
cvssv3.1 10.0 https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2
cvssv3.1_qr CRITICAL https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2
generic_textual CRITICAL https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2
ssvc Track https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2
cvssv3.1 10.0 https://nvd.nist.gov/vuln/detail/CVE-2024-27298
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2024-27298
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-27298
https://github.com/parse-community/parse-server
https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504
https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833
https://github.com/parse-community/parse-server/releases/tag/6.5.0
https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20
CVE-2024-27298 https://nvd.nist.gov/vuln/detail/CVE-2024-27298
GHSA-6927-3vr9-fxf2 https://github.com/advisories/GHSA-6927-3vr9-fxf2
GHSA-6927-3vr9-fxf2 https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://github.com/parse-community/parse-server
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-05T15:39:53Z/ Found at https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-05T15:39:53Z/ Found at https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://github.com/parse-community/parse-server/releases/tag/6.5.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://github.com/parse-community/parse-server/releases/tag/6.5.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-05T15:39:53Z/ Found at https://github.com/parse-community/parse-server/releases/tag/6.5.0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-05T15:39:53Z/ Found at https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-05T15:39:53Z/ Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-27298
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.54815
EPSS Score 0.00313
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:47:16.934847+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/parse-server/CVE-2024-27298.yml 38.6.0