parse-community/parse-server · Security
Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables
- GHSA ID
- GHSA-jhgf-2h8h-ggxv
- CVE ID
- CVE-2025-68115
- Severity
- medium
- Published
- Updated
- CVSS v4
- 5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Description
Impact
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password reset and email verification HTML pages.
Patches
The patch escapes user controlled values that are inserted into the HTML pages.
Workarounds
None.
Resources
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-jhgf-2h8h-ggxv ↗
- https://nvd.nist.gov/vuln/detail/CVE-2025-68115 ↗
- https://github.com/parse-community/parse-server/pull/9985 ↗
- https://github.com/parse-community/parse-server/pull/9986 ↗
- https://github.com/advisories/GHSA-jhgf-2h8h-ggxv ↗