{"action":"Upgrade parse-server to 8.6.41 or later.","affected":[{"fixed":"9.6.0-alpha.15","introduced":"9.0.0"},{"fixed":"8.6.41","introduced":"0"}],"component":"parse-server","cve_ids":["CVE-2026-32728"],"ecosystem":"npm","epss":0.00377,"exploited":false,"fixed_versions":["9.6.0-alpha.15","8.6.41"],"ghsa_id":"GHSA-42ph-pf9q-cr72","id":"tcs_01M5KEYVMKAQ87TBEJQ73TSE91","modified_at":"2026-03-20T12:26:17.108133Z","published_at":"2026-03-16T18:46:00Z","references":["https://osv.dev/vulnerability/GHSA-42ph-pf9q-cr72","https://github.com/parse-community/parse-server/security/advisories/GHSA-42ph-pf9q-cr72","https://nvd.nist.gov/vuln/detail/CVE-2026-32728","https://github.com/parse-community/parse-server/pull/10191","https://github.com/parse-community/parse-server/pull/10192","https://github.com/parse-community/parse-server/commit/4f53ab3cad5502a51a509d53f999e00ff7217b8d","https://github.com/parse-community/parse-server/commit/c7599c577a02b97eb5e76d4e20517b0283ae73c8","https://github.com/parse-community/parse-server"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-42ph-pf9q-cr72","url":"https://osv.dev/vulnerability/GHSA-42ph-pf9q-cr72"}],"summary":"Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries"}