Medium severity · published Oct 14, 2025
CVE-2025-62374
Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs
6.4
CVSS
0.4%
EPSS
No
On KEV
Description
Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Parse-SDK-JS · parse-community
< 7.0.0-alpha.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62374
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62374
github.com
https://github.com/parse-community/Parse-SDK-JS/commit/00973987f361368659c0c4dbf669f3897520b132
github.com
https://github.com/parse-community/Parse-SDK-JS/pull/2749
github.com
https://github.com/parse-community/Parse-SDK-JS/releases/tag/7.0.0-alpha.1
github.com
https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-9f2h-7v79-mxw3