Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119126— Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys

Quick assessment

Affected
parse-community parse-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 8.6.106 之前的 Parse Server 版本，以及 9.0.0 至 9.10.5-alpha.7 之前的 9.x 版本中，当构建已保存对象时，若使用点表示法（dot notation）键且其值为 null 或 undefined，系统处理不当。这会导致写入操作被存储，但返回错误，并跳过 afterSave 触发器及 LiveQuery 事件。拥有写权限的客户端可利用此漏洞规避审计日志、通知以及派生数据的更新。

CVSS 3.1 · Low

Possible ATT&CK Techniques 1 AI

T1562.001
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119126

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys
Source: CVE Program / CVE List V5
Vulnerability Description
Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade audit logging, notifications, and derived data updates.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对因果或异常条件的不恰当检查
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
parse-community parse-server 9.0.0 ~ 9.10.5-alpha.7 -
parse-community parse-server 0 ~ 8.6.106 -

II. Public POCs for CVE-2026-119126

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119126

请登录查看更多情报信息。

Other References for CVE-2026-119126 (2)

IV. Related Vulnerabilities

Same product: parse-server
Same vendor: parse-community
Same weakness: CWE-754