Rule Explorer

Iteration over Parse logical operators ('$or', '$and', '$nor') guards recursion with only Array.isArray, which allows an attacker-supplied array-like plain object (e.g. {"0": {...}, "length": 1}) to bypass the check. Downstream query / matching / protected-field code may still iterate the value via numeric/length-based access. Add an explicit pre-check that

JSparse-serverCVE-2026-32248GHSA-MMG8-87C5-JRC2CWE-1287

Iterating over Parse logical operators ('$or', '$and', '$nor') and gating processing only on Array.isArray(where[op]) allows an attacker to supply an array-like object (e.g. { '0': {...}, length: 1 }). The Array.isArray branch is skipped while downstream code can still iterate the object, silently bypassing recursive guards (such as protectedFields enforceme

JSparse-serverCVE-2026-31840GHSA-MMG8-87C5-JRC2CWE-285CWE-704