parse-community parse-server up to 8.6.0-alpha.1 GitHub Action code injection

Summaryinfo

A vulnerability classified as critical has been found in parse-community parse-server up to 8.6.0-alpha.1. Affected is an unknown function of the component GitHub Action Handler. This manipulation causes code injection. This vulnerability is handled as CVE-2025-67727. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in parse-community parse-server up to 8.6.0-alpha.1 and classified as critical. Affected by this vulnerability is some unknown processing of the component GitHub Action Handler. The manipulation with an unknown input leads to a code injection vulnerability. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access to GitHub secrets and write permissions which are defined in the workflow. Code from a fork or lifecycle scripts is potentially included. Only the repository's CI/CD infrastructure is affected, including any public GitHub forks with GitHub Actions enabled. This issue is fixed version 8.6.0-alpha.2 and commits 6b9f896 and e3d27fe.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-67727 since 12/10/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059 for this issue.

Upgrading to version 8.6.0-alpha.2 eliminates this vulnerability. Applying the patch 6b9f8963cc3debf59cd9c5dfc5422aff9404ce9d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• parse-community

Name

• parse-server

Version

• 8.6.0-alpha.0
• 8.6.0-alpha.1

License

• open-source

Website

• Product: https://github.com/parse-community/parse-server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion