CVE-2025-57324: Medium severity Parse parse vulnerability
parse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeState function of parse version 5.3.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57324?
CVE-2025-57324 is classified as a high severity vulnerability due to its potential to cause denial of service by allowing prototype pollution.
How do I fix CVE-2025-57324?
To fix CVE-2025-57324, upgrade to parse package version 6.1.2 or later that addresses the prototype pollution issue.
Which versions of the parse package are affected by CVE-2025-57324?
CVE-2025-57324 affects parse version 5.3.0 and earlier, including all versions up to and including 5.3.0.
What could an attacker achieve by exploiting CVE-2025-57324?
An attacker could exploit CVE-2025-57324 to inject properties into Object.prototype, potentially leading to application instability or denial of service.
Is the CVE-2025-57324 vulnerability specific to certain environments?
CVE-2025-57324 affects all environments using the vulnerable versions of the parse package regardless of the platform.