CVE-2025-67727 is scored critical (CVSS 9.8) in the record, but it concerns the Parse Server repository CI/CD workflow, not the runtime package. Forks should sync to the fixing commits, in release 8.6.0-alpha.2. The project advisory rates it medium, not critical.
What's affected
This is not a flaw in the Parse Server package that you deploy. The GitHub advisory states that it affects the repository's CI/CD infrastructure only, including public GitHub forks that have GitHub Actions enabled. The record says versions before 8.6.0-alpha.2 are affected and gives commits 6b9f896 and e3d27fe as the fix.
Severity differs. The NVD record shows 9.8, critical. The project advisory rates it medium. The gap is understandable: the base score describes a worst case, while the advisory scopes it to repository infrastructure. If you only run Parse Server as an application dependency, the advisory says you are not exposed through this issue.
How to check if you're exposed
If you maintain a fork, check whether your workflows still carry the old trigger. List workflows that use the pull_request_target event:
grep -rln "pull_request_target" .github/workflows
For each hit, read whether it checks out code from the pull request and then installs dependencies or runs scripts. Also confirm that your fork's alpha and release branches include the two fixing commits:
git log --oneline | grep -E "6b9f896|e3d27fe"
What to do now
- If you run Parse Server only as a dependency, no action is required for this CVE.
- If you maintain a public fork, push the latest upstream commits to your alpha and release branches, as the advisory instructs.
- Review your own workflows that use pull_request_target and avoid checking out untrusted code in them.
- Reduce workflow token permissions to read only unless a job truly needs more.
- Rotate any secrets that were available to such workflows if you suspect untrusted code ran.
Why it matters
The pull_request_target trigger runs in the context of the base repository, which gives the workflow access to secrets and write permissions. The advisory explains the risk: if the workflow also checks out pull request code and installs dependencies, install scripts defined by the pull request author can run with those privileges.
This is a supply chain problem more than an application bug. The classes are CWE-269, improper privilege management, and CWE-94, code injection. Many projects have this same workflow shape, so the advisory is a prompt to audit your own pipelines. The record does not list this CVE as known exploited.
Quick check
Do I need to upgrade my Parse Server deployment?
The advisory says this is not a package vulnerability. It concerns repository CI infrastructure, so deployments are not described as affected.
What should fork owners do?
Bring the alpha and release branches up to date with the parent repository so the permission changes apply.
Sources
Last reviewed: 18 October 2026.
