{"action":"Upgrade parse-server to 8.6.59 or later.","affected":[{"fixed":"9.6.0-alpha.53","introduced":"9.0.0"},{"fixed":"8.6.59","introduced":"0"}],"component":"parse-server","cve_ids":["CVE-2026-33539"],"ecosystem":"npm","epss":0.00692,"exploited":false,"fixed_versions":["9.6.0-alpha.53","8.6.59"],"ghsa_id":"GHSA-p2w6-rmh7-w8q3","id":"tcs_01M5KG2ASDQBKCPYHTNAV9D16T","modified_at":"2026-03-27T22:03:50.528822Z","published_at":"2026-03-24T19:12:06Z","references":["https://osv.dev/vulnerability/GHSA-p2w6-rmh7-w8q3","https://github.com/parse-community/parse-server/security/advisories/GHSA-p2w6-rmh7-w8q3","https://nvd.nist.gov/vuln/detail/CVE-2026-33539","https://github.com/parse-community/parse-server/pull/10272","https://github.com/parse-community/parse-server/pull/10273","https://github.com/parse-community/parse-server/commit/03249f9bf5b8783c8b848f84dab791ff0b761b8c","https://github.com/parse-community/parse-server/commit/bdddab5f8b61a40cb8fc62dd895887bdd2f3838e","https://github.com/parse-community/parse-server"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-p2w6-rmh7-w8q3","url":"https://osv.dev/vulnerability/GHSA-p2w6-rmh7-w8q3"}],"summary":"Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter"}