Critical severity10.0NVD Advisory· Published Mar 1, 2024· Updated Jun 17, 2026
CVE-2024-27298
CVE-2024-27298
Description
parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
parse-servernpm | < 6.5.0 | 6.5.0 |
parse-servernpm | >= 7.0.0-alpha.1, < 7.0.0-alpha.20 | 7.0.0-alpha.20 |
Affected products
26cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*+ 22 more
- cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*range: <6.5.0
- cpe:2.3:a:parseplatform:parse-server:6.5.0:alpha1:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:6.5.0:alpha2:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:6.5.0:beta1:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha10:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha11:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha12:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha13:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha14:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha15:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha16:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha17:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha18:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha19:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha1:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha2:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha3:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha4:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha5:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha6:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha7:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha8:*:*:*:node.js:*:*
- cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha9:*:*:*:node.js:*:*
- osv-coords2 versions
< 6.5.0+ 1 more
- (no CPE)range: < 6.5.0
- (no CPE)range: < 6.5.0
- Range: < 6.5.0
Patches
Vulnerability mechanics
References
7- github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504nvdPatchWEB
- github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833nvdPatchWEB
- github.com/advisories/GHSA-6927-3vr9-fxf2ghsaADVISORY
- github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-27298ghsaADVISORY
- github.com/parse-community/parse-server/releases/tag/6.5.0nvdRelease NotesWEB
- github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.