Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types
Impact
An attacker can upload a file with a file extension or content type that is not blocked by the default configuration of the Parse Server fileUpload.fileExtensions option. The file can contain malicious code, for example JavaScript in an SVG or XHTML file. When the file is accessed via its URL, the browser renders the file and executes the malicious code in the context of the Parse Server domain. This is a stored Cross-Site Scripting (XSS) vulnerability that can be exploited to steal session tokens, redirect users, or perform actions on behalf of other users.
Affected file extensions and content types include .svgz, .xht, .xml, .xsl, .xslt, and content types application/xhtml+xml and application/xslt+xml for extensionless uploads. Uploading of .html, .htm, .shtml, .xhtml, and .svg files was already blocked.
Patches
The fix adds the missing file extensions and content types to the default value of the fileUpload.fileExtensions server option.
Workarounds
Configure the fileUpload.fileExtensions server option to block the affected file extensions and content types.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-v5hf-f4c3-m5rv
- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.4
- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.30
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | parse-server | >= 9.0.0-alpha.1, < 9.6.0-alpha.4, < 8.6.30 | 9.6.0-alpha.4, 8.6.30 |
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-v5hf-f4c3-m5rv
- https://nvd.nist.gov/vuln/detail/CVE-2026-31868
- https://github.com/parse-community/parse-server
- https://github.com/parse-community/parse-server/releases/tag/8.6.30
- https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.4
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N- Weakness (CWE)
CWE-79- Platform
- npm
- Package
parse-server- Disclosed
- 11.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-v5hf-f4c3-m5rv - CC BY 4.0
Vulnerability history: parse-server
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 116
- First → latest
- 06.2019 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 17
- High 49
- Medium 40
- Low 10
Disclosures per year
- 2019: 2
- 2020: 4
- 2021: 4
- 2022: 12
- 2023: 5
- 2024: 4
- 2025: 6
- 2026: 79
-
Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.