GHSA-r899-h629-j84r

Source

https://github.com/advisories/GHSA-r899-h629-j84r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-r899-h629-j84r/GHSA-r899-h629-j84r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-r899-h629-j84r

Aliases

Published

2026-10-29T16:33:48Z

Modified

2026-10-29T16:45:04Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

Details

Impact

Parse Server's file upload validation uses the fileUpload.fileExtensions option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type and passes it to the storage adapter. A malformed Content-Type that is not a valid type/subtype media type — for example image (no subtype), image/ (empty subtype), or image//svg+xml (invalid token) — bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded Content-Type (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed Content-Type and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the Content-Type from the filename and serves files with X-Content-Type-Options: nosniff.

Patches

The file upload handler now validates that the client-supplied Content-Type is a well-formed media type (type/subtype with non-empty tokens per RFC 9110 §5.6.2) whenever the filename extension is not recognized by mime. Malformed values are rejected instead of being stored, while well-formed types — including custom or vendor types that the mime package does not recognize — continue to be accepted; only blocklisted subtypes are rejected.

Workarounds

Configure fileUpload.fileExtensions as a strict allowlist of only the extensions the application needs (for example ["^(png|jpe?g|gif|pdf)$"]). Additionally, serve uploaded files from a domain separate from the application so that any rendered content is isolated from the application's origin, and configure the storage/CDN layer to send X-Content-Type-Options: nosniff.

References

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r
Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10521
Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10523

Database specific

{
    "cwe_ids":  [
        "CWE-434"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-29T16:33:48Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

npm / parse-server

Package

Name: parse-server; View open source insights on deps.dev
Purl: pkg:npm/parse-server

Affected ranges

Type: SEMVER
Events: Introduced

9.0.0

Fixed

9.10.0-alpha.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-r899-h629-j84r/GHSA-r899-h629-j84r.json"

npm / parse-server

Package

Name: parse-server; View open source insights on deps.dev
Purl: pkg:npm/parse-server

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

8.6.84

Database specific

last_known_affected_version_range

"<= 8.6.83"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-r899-h629-j84r/GHSA-r899-h629-j84r.json"