GitHub Advisoryadvisory · npm

GHSA-3534-xp88-25rc Parse Dashboard is Missing CSRF Protection for its Agent Endpoint

HIGH Published 2026-02-25 Modified 2026-02-25 Official page ↗
Aliases
CVE-2026-27609
Ecosystem
npm
Packages
parse-dashboard
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Weaknesses
CWE-352
Reviewed
2026-02-25

Affected packages

• npm parse-dashboard: >= 7.3.0-alpha.42, < 9.0.0-alpha.8 → fixed in 9.0.0-alpha.8

Description

Impact The AI Agent API endpoint (`POST /apps/:appId/agent`) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session. Patches The fix adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page. Workarounds Remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected. Resources • GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-3534-xp88-25rc • Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8

Related

Alias · CVE (1)

  • CVE-2026-27609 Parse Dashboard is a standalone dashboard for managing Parse Server apps. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References