CVE-2025-62374CWE-1321

CVE-2025-62374

Medium · published October 15, 2025

CVSS v3.1
6.4
EPSS
0%
Percentile
34.1
In the wild
Unconfirmed
What it is

Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00410 · 34.1th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2025-10-15T00:15Z
References (4)
https://github.com/parse-community/Parse-SDK-JS/commit/00973987f361368659c0c4dbf669f3897520b132 · [email protected]https://github.com/parse-community/Parse-SDK-JS/pull/2749 · [email protected]https://github.com/parse-community/Parse-SDK-JS/releases/tag/7.0.0-alpha.1 · [email protected]https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-9f2h-7v79-mxw3 · [email protected]
EPSS history
Timeline
  • 14 OCT 20:06Z
    Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs
    cvelistv5