CVE-2025-62374

Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs

CVSS 6.4 MEDIUMEPSS 0.4%CWE-1321

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 6.4EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

14 out 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L

Produtos afetados

parse-community · Parse-SDK-JS

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/parse-community/Parse-SDK-JS/commit/00973987f361368659c0c4dbf669f3897520b132 https://github.com/parse-community/Parse-SDK-JS/pull/2749 https://github.com/parse-community/Parse-SDK-JS/releases/tag/7.0.0-alpha.1 https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-9f2h-7v79-mxw3