{"id":"CVE-2024-27298","aliases":["BIT-parse-2024-27298","EUVD-2024-0843","GHSA-6927-3vr9-fxf2"],"status":"published","title":"Parse Server literalizeRegexPart SQL Injection","description":"parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-13","score":0.0103,"percentile":0.64205,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2024-03-01T17:48:52Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"npm","package":"parse-server","fixed_in":["6.5.0","7.0.0-alpha.20"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"parse","fixed_in":["6.5.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"parse-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"parse-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0-alpha.1"},{"fixed":"7.0.0-alpha.20"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"parse","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.5.0"}]}]},{"source":"osv","ecosystem":"npm","package":"parse-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.5.0"}]}]},{"source":"osv","ecosystem":"npm","package":"parse-server","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0-alpha.1"},{"fixed":"7.0.0-alpha.20"}]}]}],"products":[{"vendor":"parse-community","product":"parse-server"},{"vendor":"parseplatform","product":"parse-server"}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/parse-community/parse-server/releases/tag/6.5.0","tags":["x_refsource_MISC","x_transferred","Release Notes","article","web"]},{"url":"https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20","tags":["x_refsource_MISC","x_transferred","Release Notes","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27298","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6927-3vr9-fxf2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27298.json","tags":["advisory"]},{"url":"https://github.com/parse-community/parse-server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-27298","title":"Parse Server literalizeRegexPart SQL Injection","description":"parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.\n","status":"published","published":"2024-03-01T17:48:52.919Z","modified":"2024-08-22T18:28:04.258Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:12.635756Z"}],"euvd":[{"id":"EUVD-2024-0843","description":"parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.\n","status":"published","published":"2024-03-01T17:48:52Z","modified":"2024-08-22T18:28:04Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T00:56:12.794655Z"}],"ghsa":[{"id":"GHSA-6927-3vr9-fxf2","title":"ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection","description":"### Impact\n\nThis vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database.\n\n### Patches\n\nThe algorithm to detect SQL injection has been improved.\n\n### Workarounds\n\nNone.\n\n### References\n\n- https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2\n- https://github.com/parse-community/parse-server/releases/tag/6.5.0 (fixed in Parse Server 6)\n- https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20 (fixed in Parse Server 7 alpha release)\n\n### Credits\n\n- Mikhail Shcherbakov (https://twitter.com/yu5k3) working with Trend Micro Zero Day Initiative (finder)\n- Ehsan Persania (remediation developer)\n- Manuel Trezza (coordinator)","status":"published","published":"2024-03-01T20:08:23Z","modified":"2026-03-21T05:27:20Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:39:40.633038Z"}],"nvd":[{"id":"CVE-2024-27298","description":"parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.\n","status":"published","published":"2024-03-01T18:15:28.913Z","modified":"2026-06-17T07:19:35.94Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:09:38.473056Z"}],"osv":[{"id":"CVE-2024-27298","title":"Parse Server literalizeRegexPart SQL Injection","description":"parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.\n","status":"published","published":"2024-03-01T17:48:52.919Z","modified":"2026-10-28T02:31:12.336189221Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"GHSA-6927-3vr9-fxf2","title":"ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection","description":"### Impact\n\nThis vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database.\n\n### Patches\n\nThe algorithm to detect SQL injection has been improved.\n\n### Workarounds\n\nNone.\n\n### References\n\n- https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2\n- https://github.com/parse-community/parse-server/releases/tag/6.5.0 (fixed in Parse Server 6)\n- https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20 (fixed in Parse Server 7 alpha release)\n\n### Credits\n\n- Mikhail Shcherbakov (https://twitter.com/yu5k3) working with Trend Micro Zero Day Initiative (finder)\n- Ehsan Persania (remediation developer)\n- Manuel Trezza (coordinator)","status":"published","published":"2024-03-01T20:08:23Z","modified":"2026-09-10T03:50:10.083238719Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"BIT-parse-2024-27298","title":"Parse Server literalizeRegexPart SQL Injection","description":"parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0.","status":"published","published":"2024-03-31T18:25:01.637Z","modified":"2026-09-08T08:48:24.478233078Z","updated_at":"2026-11-02T15:28:34.343258Z"}]}}