What’s Vulnerable › Vulnerabilities

CVE-2025-62374: Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-14 · updated 2026-10-08
• Weakness: CWE-1321

Description

Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0.

Affected products

• parse-community Parse-SDK-JS: before 7.0.0-alpha.1

References

• https://github.com/parse-community/Parse-SDK-JS/commit/00973987f361368659c0c4dbf669f3897520b132
• https://github.com/parse-community/Parse-SDK-JS/pull/2749
• https://github.com/parse-community/Parse-SDK-JS/releases/tag/7.0.0-alpha.1
• https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-9f2h-7v79-mxw3

Get alerted when CVE-2025-62374 or the next vulnerability affects your stack