Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables
Date: 2025-12
Affected: npm/parse-server, npm/parse-server
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-68115
CWE: CWE-79

## Impact A Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password reset and email verification HTML pages. ## Patches The patch escapes user controlled values that are inserted into the HTML pages. ## Workarounds None. ## Resources - https://github.com/parse-community/parse-server/security/advisories/GHSA-jhgf-2h8h-ggxv - https://github.com/parse-community/parse-server/pull/9985 - https://github.com/parse-community/parse-server/pull/9986


Mitigations:

Architectural layers (MAESTRO):