CVE-2025-62374
CVE-2025-62374 · Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0.
CVSS 6.4 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
parse-sdk-js
- Versions
- < 7.0.0-alpha.1: Affected
No fix published
parse npm
- Affected ranges
- SEMVER: < 7.0.0
Update to 7.0.0
Original sources
- https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-9f2h-7v79-mxw3
- https://github.com/parse-community/Parse-SDK-JS/pull/2749
- https://github.com/parse-community/Parse-SDK-JS/commit/00973987f361368659c0c4dbf669f3897520b132
- https://github.com/parse-community/Parse-SDK-JS/releases/tag/7.0.0-alpha.1
- https://nvd.nist.gov/vuln/detail/CVE-2025-62374