CVE-2025-62374 Details
Description
Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0.
A prototype pollution vulnerability has been identified in the Parse JavaScript SDK, specifically in version 7.0.0 and prior. This vulnerability allows for the injection of malicious payloads, which can lead to the remote execution of arbitrary code. The issue affects the `ParseObject.fromJSON`, `ParseObject.pin`, `ParseObject.registerSubclass`, `ObjectStateMutations`, and the internal `encode`/`decode` APIs. The vulnerability arises from insufficient validation of property names, enabling the manipulation of the prototype chain.
Users can upgrade to Parse JavaScript SDK version 7.0.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2025CISA-ADP
Assessed Oct 14, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/Parse-SDK-JS/commit/00973987f361368659c0c4dbf669f3897520b132 | [email protected] | Source CodeVendor |
| https://github.com/parse-community/Parse-SDK-JS/pull/2749 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/parse-community/Parse-SDK-JS/releases/tag/7.0.0-alpha.1 | [email protected] | Release NotesVendor |
| https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-9f2h-7v79-mxw3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Parse | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2025 | New CVE Received | [email protected] |