CVE-2025-62374: Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs
Summary
Prototype pollution capabilities on various APIs.
Details
Injection of malicious payload allows attacker to remotely execute arbitrary code. Parse.Object and internal APIs are affected, specifically: - ParseObject.fromJSON - ParseObject.pin - ParseObject.registerSubclass - ObjectStateMutations (internal) - encode/decode (internal)
PoC
Demonstrative tests added as part of the fix.
References
- https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-9f2h-7v79-mxw3 - Patch https://github.com/parse-community/Parse-SDK-JS/releases/tag/7.0.0-alpha.1
Other sources
Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62374?
CVE-2025-62374 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-62374?
To fix CVE-2025-62374, update the Parse Javascript SDK to version 7.0.0 or later.
Which versions of Parse Javascript SDK are affected by CVE-2025-62374?
CVE-2025-62374 affects all versions prior to 7.0.0 of the Parse Javascript SDK.
What type of attack does CVE-2025-62374 enable?
CVE-2025-62374 enables an attacker to execute arbitrary code remotely on affected systems.
Is there a workaround for CVE-2025-62374 while waiting for a fix?
There are no official workarounds for CVE-2025-62374, so upgrading to the patched version is recommended.