{"items":[{"id":"NVI-00008922","kind":"vulnerability","title":"Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-r899-h629-j84r","CVE-2026-61448"],"plain_summary":"GitHub lists this reviewed advisory for parse-server, parse-server. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-ad5300249ec27ea97bbd8458e37df813"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 9.10.0-alpha.2 for parse-server. Confirm the publisher’s latest guidance.","source_ids":["sr-07fe0071e69cec689dce2067ef7ba704"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.6.84 for parse-server. Confirm the publisher’s latest guidance.","source_ids":["sr-07fe0071e69cec689dce2067ef7ba704"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.415%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.35785. Missing scores are unknown.","source_id":"sr-ad5300249ec27ea97bbd8458e37df813"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-301168d0a18a5785e9527601960ea7de","url":"https://github.com/advisories/GHSA-r899-h629-j84r","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-r899-h629-j84r","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:08.420Z"},{"id":"sr-07fe0071e69cec689dce2067ef7ba704","url":"https://github.com/advisories/GHSA-r899-h629-j84r","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-r899-h629-j84r","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-01T07:23:28.308Z"},{"id":"sr-ad5300249ec27ea97bbd8458e37df813","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-61448","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.383Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-301168d0a18a5785e9527601960ea7de"],"technology":"parse-server","known_exclusions":[],"conditions_summary":"### Impact\n\nParse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the `mime` package, Parse Server preserves the client-supplied `Content-Type` and passes it to the storage adapter. A malformed `Content-Type` that is not a valid `type/subtype` media type — for example `image` (no subtype), `image/` (empty subtype), or `image//svg+xml` (invalid token) — bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded `Content-Type` (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed `Content-Type` and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the `","public_affected_ranges":[">= 9.0.0, < 9.10.0-alpha.2"]},{"certainty":"source_listed","source_ids":["sr-301168d0a18a5785e9527601960ea7de"],"technology":"parse-server","known_exclusions":[],"conditions_summary":"### Impact\n\nParse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the `mime` package, Parse Server preserves the client-supplied `Content-Type` and passes it to the storage adapter. A malformed `Content-Type` that is not a valid `type/subtype` media type — for example `image` (no subtype), `image/` (empty subtype), or `image//svg+xml` (invalid token) — bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded `Content-Type` (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed `Content-Type` and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the `","public_affected_ranges":["<= 8.6.83"]},{"certainty":"source_listed","source_ids":["sr-07fe0071e69cec689dce2067ef7ba704"],"technology":"parse-server","known_exclusions":[],"conditions_summary":"### Impact\n\nParse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the `mime` package, Parse Server preserves the client-supplied `Content-Type` and passes it to the storage adapter. A malformed `Content-Type` that is not a valid `type/subtype` media type — for example `image` (no subtype), `image/` (empty subtype), or `image//svg+xml` (invalid token) — bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded `Content-Type` (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed `Content-Type` and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the `","public_affected_ranges":["SEMVER: introduced 9.0.0; fixed 9.10.0-alpha.2"]},{"certainty":"source_listed","source_ids":["sr-07fe0071e69cec689dce2067ef7ba704"],"technology":"parse-server","known_exclusions":[],"conditions_summary":"### Impact\n\nParse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the `mime` package, Parse Server preserves the client-supplied `Content-Type` and passes it to the storage adapter. A malformed `Content-Type` that is not a valid `type/subtype` media type — for example `image` (no subtype), `image/` (empty subtype), or `image//svg+xml` (invalid token) — bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded `Content-Type` (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed `Content-Type` and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the `","public_affected_ranges":["SEMVER: introduced 0; fixed 8.6.84"]}],"null_published_at":"2026-11-05T03:52:54.767Z","source_updated_at":"2026-10-29T16:33:49.000Z","source_disclosed_at":"2026-10-29T16:33:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:56:08.420Z"},{"id":"NVI-00008922","kind":"vulnerability","title":"Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-r899-h629-j84r","CVE-2026-61448"],"plain_summary":"GitHub lists this reviewed advisory for parse-server, parse-server. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-301168d0a18a5785e9527601960ea7de"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 9.10.0-alpha.2 for parse-server. Confirm the publisher’s latest guidance.","source_ids":["sr-07fe0071e69cec689dce2067ef7ba704"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.6.84 for parse-server. Confirm the publisher’s latest guidance.","source_ids":["sr-07fe0071e69cec689dce2067ef7ba704"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-301168d0a18a5785e9527601960ea7de","url":"https://github.com/advisories/GHSA-r899-h629-j84r","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-r899-h629-j84r","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:08.420Z"},{"id":"sr-07fe0071e69cec689dce2067ef7ba704","url":"https://github.com/advisories/GHSA-r899-h629-j84r","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-r899-h629-j84r","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-01T07:23:28.308Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-301168d0a18a5785e9527601960ea7de"],"technology":"parse-server","known_exclusions":[],"conditions_summary":"### Impact\n\nParse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the `mime` package, Parse Server preserves the client-supplied `Content-Type` and passes it to the storage adapter. A malformed `Content-Type` that is not a valid `type/subtype` media type — for example `image` (no subtype), `image/` (empty subtype), or `image//svg+xml` (invalid token) — bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded `Content-Type` (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed `Content-Type` and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the `","public_affected_ranges":[">= 9.0.0, < 9.10.0-alpha.2"]},{"certainty":"source_listed","source_ids":["sr-301168d0a18a5785e9527601960ea7de"],"technology":"parse-server","known_exclusions":[],"conditions_summary":"### Impact\n\nParse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the `mime` package, Parse Server preserves the client-supplied `Content-Type` and passes it to the storage adapter. A malformed `Content-Type` that is not a valid `type/subtype` media type — for example `image` (no subtype), `image/` (empty subtype), or `image//svg+xml` (invalid token) — bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded `Content-Type` (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed `Content-Type` and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the `","public_affected_ranges":["<= 8.6.83"]},{"certainty":"source_listed","source_ids":["sr-07fe0071e69cec689dce2067ef7ba704"],"technology":"parse-server","known_exclusions":[],"conditions_summary":"### Impact\n\nParse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the `mime` package, Parse Server preserves the client-supplied `Content-Type` and passes it to the storage adapter. A malformed `Content-Type` that is not a valid `type/subtype` media type — for example `image` (no subtype), `image/` (empty subtype), or `image//svg+xml` (invalid token) — bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded `Content-Type` (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed `Content-Type` and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the `","public_affected_ranges":["SEMVER: introduced 9.0.0; fixed 9.10.0-alpha.2"]},{"certainty":"source_listed","source_ids":["sr-07fe0071e69cec689dce2067ef7ba704"],"technology":"parse-server","known_exclusions":[],"conditions_summary":"### Impact\n\nParse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the `mime` package, Parse Server preserves the client-supplied `Content-Type` and passes it to the storage adapter. A malformed `Content-Type` that is not a valid `type/subtype` media type — for example `image` (no subtype), `image/` (empty subtype), or `image//svg+xml` (invalid token) — bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded `Content-Type` (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed `Content-Type` and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the `","public_affected_ranges":["SEMVER: introduced 0; fixed 8.6.84"]}],"null_published_at":"2026-11-01T14:34:14.081Z","source_updated_at":"2026-10-29T16:33:49.000Z","source_disclosed_at":"2026-10-29T16:33:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:56:08.420Z"},{"id":"NVI-00008922","kind":"vulnerability","title":"Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-r899-h629-j84r","CVE-2026-61448"],"plain_summary":"GitHub lists this reviewed advisory for parse-server, parse-server. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-301168d0a18a5785e9527601960ea7de"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-301168d0a18a5785e9527601960ea7de","url":"https://github.com/advisories/GHSA-r899-h629-j84r","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-r899-h629-j84r","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:08.420Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-301168d0a18a5785e9527601960ea7de"],"technology":"parse-server","known_exclusions":[],"conditions_summary":"### Impact\n\nParse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the `mime` package, Parse Server preserves the client-supplied `Content-Type` and passes it to the storage adapter. A malformed `Content-Type` that is not a valid `type/subtype` media type — for example `image` (no subtype), `image/` (empty subtype), or `image//svg+xml` (invalid token) — bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded `Content-Type` (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed `Content-Type` and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the `","public_affected_ranges":[">= 9.0.0, < 9.10.0-alpha.2"]},{"certainty":"source_listed","source_ids":["sr-301168d0a18a5785e9527601960ea7de"],"technology":"parse-server","known_exclusions":[],"conditions_summary":"### Impact\n\nParse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the `mime` package, Parse Server preserves the client-supplied `Content-Type` and passes it to the storage adapter. A malformed `Content-Type` that is not a valid `type/subtype` media type — for example `image` (no subtype), `image/` (empty subtype), or `image//svg+xml` (invalid token) — bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded `Content-Type` (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed `Content-Type` and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the `","public_affected_ranges":["<= 8.6.83"]}],"null_published_at":"2026-10-31T22:13:27.122Z","source_updated_at":"2026-10-29T16:33:49.000Z","source_disclosed_at":"2026-10-29T16:33:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:08.420Z"}],"next_cursor":null,"snapshot_revision":"42594"}