GHSA-JHGF-2H8H-GGXV
Vulnerability from github – Published: 2025-12-16 19:36 – Updated: 2025-12-16 19:36
VLAI?
Summary
Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables
Details
Impact
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password reset and email verification HTML pages.
Patches
The patch escapes user controlled values that are inserted into the HTML pages.
Workarounds
None.
Resources
- https://github.com/parse-community/parse-server/security/advisories/GHSA-jhgf-2h8h-ggxv
- https://github.com/parse-community/parse-server/pull/9985
- https://github.com/parse-community/parse-server/pull/9986
Severity ?
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.1.0-alpha.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-68115"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-16T19:36:37Z",
"nvd_published_at": "2025-12-16T01:15:53Z",
"severity": "MODERATE"
},
"details": "## Impact\n\nA Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server\u0027s password reset and email verification HTML pages.\n\n## Patches\n\nThe patch escapes user controlled values that are inserted into the HTML pages.\n\n## Workarounds\n\nNone.\n\n## Resources\n\n- https://github.com/parse-community/parse-server/security/advisories/GHSA-jhgf-2h8h-ggxv\n- https://github.com/parse-community/parse-server/pull/9985\n- https://github.com/parse-community/parse-server/pull/9986",
"id": "GHSA-jhgf-2h8h-ggxv",
"modified": "2025-12-16T19:36:37Z",
"published": "2025-12-16T19:36:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-jhgf-2h8h-ggxv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68115"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/pull/9985"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/pull/9986"
},
{
"type": "PACKAGE",
"url": "https://github.com/parse-community/parse-server"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…