Critical
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
Type: advisorySources: OSV
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-39309
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 17:04 UTC · Revision 1
Source evidence
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
core-osv · Original sourcePublished 1 Jul 2024, 21:15 UTC
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.
osv:CVE-2024-39309
Complete source record
{
"id": "169df1f96c5eda6ca2a2e9e1da877c84543c3743487061a11626e27c903d88fe",
"url": "https://osv.dev/vulnerability/CVE-2024-39309",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability",
"summary": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.",
"evidence": "osv:CVE-2024-39309",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2024-39309",
"aliases": [
"BIT-parse-2024-39309",
"CVE-2024-39309",
"GHSA-c2hr-cqg6-8j6r"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/parse-community/parse-server",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "52729fd15c5ca5b02bfc293cf74967105b04b5f3"
},
{
"introduced": "c83de8c4eabb130fc4269361861f12df0abe3351"
},
{
"fixed": "4906644d671aff66186ad19161bf84504282a243"
},
{
"fixed": "2edf1e4c0363af01e97a7fbc97694f851b7d1ff3"
},
{
"fixed": "f332d54577608c5ad927255e06d8c694e2e0ff5b"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "6.5.7"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.1.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "2edf1e4c0363af01e97a7fbc97694f851b7d1ff3"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "f332d54577608c5ad927255e06d8c694e2e0ff5b"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"7.0.0",
"7.1.0-alpha.11",
"6.5.6",
"7.1.0-alpha.10",
"7.1.0-alpha.9",
"7.1.0-alpha.8",
"7.1.0-alpha.7",
"7.1.0-alpha.6",
"7.1.0-alpha.5",
"7.1.0-alpha.4",
"7.1.0-alpha.3",
"7.1.0-alpha.2",
"7.1.0-alpha.1",
"7.0.0-alpha.31",
"7.0.0-alpha.30",
"7.0.0-beta.1",
"6.5.5",
"6.4.0",
"6.5.0-beta.1",
"6.5.4",
"6.5.3",
"6.5.2",
"6.5.1",
"6.5.0",
"6.5.0-alpha.2",
"6.5.0-alpha.1",
"6.3.1",
"6.3.0",
"6.2.2",
"6.2.1",
"6.2.0",
"6.1.0",
"6.0.0",
"5.4.0",
"5.3.3",
"5.3.2",
"5.3.1",
"5.3.0",
"5.2.8",
"5.2.7",
"5.2.6",
"5.2.5",
"5.2.4",
"5.2.3",
"5.2.2",
"5.2.1",
"5.2.0",
"5.1.1",
"5.1.0",
"5.0.0",
"5.0.0-alpha.1",
"4.5.0",
"4.4.0",
"4.3.0",
"4.2.0",
"4.1.0",
"4.0.2",
"4.0.1",
"4.0.0",
"3.10.0",
"3.9.0",
"3.8.0",
"3.7.2",
"3.7.1",
"3.7.0",
"3.6.0",
"3.5.0",
"3.4.0",
"3.4.1",
"3.3.0",
"3.2.3",
"3.2.2",
"3.2.1",
"3.2.0",
"3.1.3",
"3.1.2",
"3.1.1",
"3.1.0",
"3.0.0",
"2.8.2",
"2.8.0",
"2.7.4",
"2.7.3",
"2.7.2",
"2.7.1",
"2.7.0",
"2.6.5",
"2.6.4",
"2.6.3",
"2.6.2",
"2.6.1",
"2.6.0",
"2.5.3",
"2.5.2",
"2.5.1",
"2.5.0",
"2.4.2",
"2.4.1",
"2.4.0",
"2.3.8",
"2.3.7",
"2.3.6",
"2.3.5",
"2.3.4",
"2.3.3",
"2.3.2",
"2.3.1",
"2.2.25",
"2.2.25-beta.1",
"2.2.24",
"2.2.23",
"2.2.22",
"2.2.21",
"2.2.20",
"2.2.19",
"2.2.18",
"2.2.17",
"2.2.16",
"2.2.15",
"2.2.14",
"2.2.13",
"2.2.12",
"2.2.11",
"2.2.10",
"2.2.9",
"2.2.8",
"2.2.7",
"2.2.6",
"2.2.5",
"2.2.4",
"2.2.3",
"2.2.2",
"2.2.1",
"2.2.0",
"2.1.6",
"2.1.5",
"2.1.4",
"2.1.3",
"2.1.2",
"2.1.1",
"2.1.0",
"2.0.8",
"2.0.7",
"2.0.3",
"2.0.6",
"2.0.5",
"2.0.4",
"2.0.2",
"2.0.1",
"2.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39309.json"
}
}
],
"modified": "2026-10-28T02:30:30.481687467Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39309.json",
"https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r",
"https://nvd.nist.gov/vuln/detail/CVE-2024-39309",
"https://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3",
"https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5b",
"https://github.com/parse-community/parse-server/pull/9167",
"https://github.com/parse-community/parse-server/pull/9168"
],
"provider_metadata": {
"cwe_ids": [
"CWE-288",
"CWE-89"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39309.json"
}
},
"related_cves": [
{
"value": "CVE-2024-39309",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 497685,
"published_at": "2024-07-01T21:15:26.242+00:00"
}