{"action":"Upgrade parse-server to 8.6.70 or later.","affected":[{"fixed":"9.7.0-alpha.16","introduced":"9.0.0"},{"fixed":"8.6.70","introduced":"0"}],"component":"parse-server","cve_ids":["CVE-2026-34595"],"ecosystem":"npm","epss":0.00431,"exploited":false,"fixed_versions":["9.7.0-alpha.16","8.6.70"],"ghsa_id":"GHSA-mmg8-87c5-jrc2","id":"tcs_01M5KG129C87F3BM4Q0KCWFDMF","modified_at":"2026-04-06T15:27:07.776510020Z","published_at":"2026-04-01T00:07:39Z","references":["https://osv.dev/vulnerability/GHSA-mmg8-87c5-jrc2","https://github.com/parse-community/parse-server/security/advisories/GHSA-mmg8-87c5-jrc2","https://nvd.nist.gov/vuln/detail/CVE-2026-34595","https://github.com/parse-community/parse-server/pull/10350","https://github.com/parse-community/parse-server/pull/10351","https://github.com/parse-community/parse-server/commit/f63fd1a3fe0a7c1c5fe809f01b0e04759e8c9b98","https://github.com/parse-community/parse-server/commit/ffad0ec6b971ee0dd9545e1bf1fb34ddebf275c2","https://github.com/parse-community/parse-server"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-mmg8-87c5-jrc2","url":"https://osv.dev/vulnerability/GHSA-mmg8-87c5-jrc2"}],"summary":"Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value"}