{"schema":"threatline.record/2","record":{"id":"GHSA-gpr6-gr9g-pfw6","aliases":["GHSA-gpr6-gr9g-pfw6"],"summary":"Server crash via file pointer without URL in an object write","details":"### Impact\r\n\r\nAn attacker can crash the Parse Server process by saving an object that contains a file reference without a URL. This affects any class that has a Cloud Code save, find or delete trigger, or that is enabled for LiveQuery; with public write access to such a class, including user sign-up, no authentication is required. A file reference without a URL nested in an object or array can also be stored, after which requests that run a trigger or LiveQuery on that object fail.\r\n\r\n### Patches\r\n\r\nFile references without a URL are now resolved before objects are passed to Cloud Code triggers and LiveQuery, including file references nested in objects and arrays and file references set by a `beforeSave` trigger. Nested file references in query responses are now also resolved. File references with a missing or invalid name are rejected. Errors in the LiveQuery notification after a save are now caught and logged instead of terminating the process.\r\n\r\n### Workarounds\r\n\r\nAdd a middleware before Parse Server that rejects write requests whose body contains an object with `__type` set to `File` that has no `url`, or whose `name` is not a string. Note that this also rejects legitimate requests that reference an existing file by name only.\r\n\r\n### References\r\n\r\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-gpr6-gr9g-pfw6\r\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10694\r\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10695\r\n","categories":["Unclassified"],"product":"parse-server","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-gpr6-gr9g-pfw6","source_modified_at":"2026-09-25T22:16:10Z","fetched_at":"2026-10-23T21:14:28.314422Z","package":{"ecosystem":"npm","name":"parse-server"},"range":">= 9.0.0, < 9.10.2-alpha.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-gpr6-gr9g-pfw6","source_modified_at":"2026-09-25T22:16:10Z","fetched_at":"2026-10-23T21:14:28.314422Z","package":{"ecosystem":"npm","name":"parse-server"},"range":"< 8.6.95"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-gpr6-gr9g-pfw6","source_modified_at":"2026-09-25T22:16:10Z","fetched_at":"2026-10-23T21:14:28.314422Z","package":{"ecosystem":"npm","name":"parse-server"},"version":"9.10.2-alpha.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-gpr6-gr9g-pfw6","source_modified_at":"2026-09-25T22:16:10Z","fetched_at":"2026-10-23T21:14:28.314422Z","package":{"ecosystem":"npm","name":"parse-server"},"version":"8.6.95"}],"cvss":8.2,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-25T22:16:10Z","modified_at":"2026-09-25T22:16:10Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-gpr6-gr9g-pfw6","fetched_at":"2026-10-23T21:14:28.314422Z","source_modified_at":"2026-09-25T22:16:10Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-25T22:16:10Z","content_hash":"543c0e88375dc93f572f3cab973cd0966dbe79ee8337f5a00f414b66715f3ccc"}}