SQL injection via `Increment` operation on nested object field in PostgreSQL ([GHSA-q3vj-96h2-gwvg](https://github.com/parse-community/parse-server/security/advisories/GHSA-q3vj-96h2-gwvg))
fix: SQL injection via `Increment` operation on nested object field in PostgreSQL ([GHSA-q3vj-96h2-gwvg](https://github.com/parse-community/parse-server/security/advisories/GHSA-q3vj-96h2-gwvg)) (#10161)
SQL injection via `Increment` operation on nested object field in PostgreSQL ([GHSA-q3vj-96h2-gwvg](https://github.com/parse-community/parse-server/security/advisories/GHSA-q3vj-96h2-gwvg))8f8228-fix-sql-injection-via-increment-operation-on-cve-2026-31856fixsql injection via increment operation nested
Committed by mtrezza
commit message
fix: SQL injection via `Increment` operation on nested object field in PostgreSQL ([GHSA-q3vj-96h2-gwvg](https://github.com/parse-community/parse-server/security/advisories/GHSA-q3vj-96h2-gwvg)) (#10161)Editor assessment
This commit patches CVE-2026-31856. The subject says SQL injection occurs through an `Increment` operation on a nested object field in PostgreSQL, combining the operation, the field shape, and the database into a precise diagnosis. The `fix` type fits. No body follows, so how the nested field name reached the query and what escaping or validation was added is left undocumented. The header also carries an inline GHSA markdown link and PR reference, which inflates its length. The summary is clear enough to orient a maintainer, but the missing explanation and clutter hold it back.