parse-community/parse-sdk-js · Security
Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs
- GHSA ID
- GHSA-9f2h-7v79-mxw3
- CVE ID
- CVE-2025-62374
- Severity
- medium
- Published
- Updated
- CVSS
- 6.4 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
- CVSS v3
- 6.4 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
Description
Summary
Prototype pollution capabilities on various APIs.
Details
Injection of malicious payload allows attacker to remotely execute arbitrary code. Parse.Object and internal APIs are affected, specifically:
ParseObject.fromJSONParseObject.pinParseObject.registerSubclassObjectStateMutations(internal)encode/decode(internal)
PoC
Demonstrative tests added as part of the fix.
References
CWEs
- CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
References
- https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-9f2h-7v79-mxw3 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2025-62374 ↗
- https://github.com/parse-community/Parse-SDK-JS/pull/2749 ↗
- https://github.com/parse-community/Parse-SDK-JS/commit/00973987f361368659c0c4dbf669f3897520b132 ↗
- https://github.com/parse-community/Parse-SDK-JS/releases/tag/7.0.0-alpha.1 ↗
- https://github.com/advisories/GHSA-9f2h-7v79-mxw3 ↗