GHSA-jhgf-2h8h-ggxvMedium

Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables

Published
December 16, 2025
Last Modified
December 16, 2025

🔗 CVE IDs covered (1)

CVE-2025-68115 →

📋 Description

Impact

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password reset and email verification HTML pages.

Patches

The patch escapes user controlled values that are inserted into the HTML pages.

Workarounds

None.

Resources

  • https://github.com/parse-community/parse-server/security/advisories/GHSA-jhgf-2h8h-ggxv
  • https://github.com/parse-community/parse-server/pull/9985
  • https://github.com/parse-community/parse-server/pull/9986

🎯 Affected products2

  • npm/parse-server:< 8.6.1
  • npm/parse-server:>= 9.0.0, < 9.1.0-alpha.3

🔗 References (5)