{"action":"Upgrade parse-server to 8.6.81 or later.","affected":[{"fixed":"9.9.1-alpha.11","introduced":"9.0.0"},{"fixed":"8.6.81","introduced":"0"}],"component":"parse-server","cve_ids":["CVE-2026-55778"],"ecosystem":"npm","epss":0.00553,"exploited":false,"fixed_versions":["9.9.1-alpha.11","8.6.81"],"ghsa_id":"GHSA-v8x7-r927-cc93","id":"tcs_01M5KGBBGRSS5CKB3MKT7C15RH","modified_at":"2026-07-14T16:40:35.629992595Z","published_at":"2026-06-19T19:36:36Z","references":["https://osv.dev/vulnerability/GHSA-v8x7-r927-cc93","https://github.com/parse-community/parse-server/security/advisories/GHSA-v8x7-r927-cc93","https://github.com/parse-community/parse-server/pull/10505","https://github.com/parse-community/parse-server/pull/10506","https://github.com/parse-community/parse-server"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-v8x7-r927-cc93","url":"https://osv.dev/vulnerability/GHSA-v8x7-r927-cc93"}],"summary":"parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist"}