CVE-2025-62374

Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.1 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/parse-community/Parse-SDK-JS/commit/00973987f361368659c0c4dbf669f3897520b132
https://github.com/parse-community/Parse-SDK-JS/pull/2749
https://github.com/parse-community/Parse-SDK-JS/releases/tag/7.0.0-alpha.1
https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-9f2h-7v79-mxw3

Configurations

No configuration.

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) El SDK de JavaScript de Parse proporciona acceso al potente backend de Parse Server desde su aplicación JavaScript. Antes de la versión 7.0.0, la inyección de carga útil maliciosa permite al atacante ejecutar código arbitrario de forma remota. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (interno), y encode/decode (interno) se ven afectados. Esta vulnerabilidad está corregida en la versión 7.0.0.

Information

Published : 2025-10-14 20:15

Updated : 2026-10-08 12:10

NVD link : CVE-2025-62374

Mitre link : CVE-2025-62374

CVE.ORG link : CVE-2025-62374

JSON object : View

Products Affected

No product.

CWE

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2025-62374", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62374", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T20:28:45.889503Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "parse-community", "product": "Parse-SDK-JS", "versions": [{"status": "affected", "version": "< 7.0.0-alpha.1"}]}]}], "published": "2025-10-14T20:15:53.550", "references": [{"url": "https://github.com/parse-community/Parse-SDK-JS/commit/00973987f361368659c0c4dbf669f3897520b132", "source": "security-advisories@github.com"}, {"url": "https://github.com/parse-community/Parse-SDK-JS/pull/2749", "source": "security-advisories@github.com"}, {"url": "https://github.com/parse-community/Parse-SDK-JS/releases/tag/7.0.0-alpha.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-9f2h-7v79-mxw3", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0."}, {"lang": "es", "value": "El SDK de JavaScript de Parse proporciona acceso al potente backend de Parse Server desde su aplicaci\u00f3n JavaScript. Antes de la versi\u00f3n 7.0.0, la inyecci\u00f3n de carga \u00fatil maliciosa permite al atacante ejecutar c\u00f3digo arbitrario de forma remota. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (interno), y encode/decode (interno) se ven afectados. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 7.0.0."}], "lastModified": "2026-10-08T12:10:00.217", "sourceIdentifier": "security-advisories@github.com"}