CVE-2025-62374

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-62374
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62374.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-62374
Aliases
Published
2025-10-14T20:06:43.697Z
Modified
2026-04-10T05:32:58.441956Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L CVSS Calculator
Summary
Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs
Details

Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62374.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1321"
    ]
}
References

Affected packages

Git / github.com/parse-community/parse-sdk-js

Affected ranges

Type
GIT
Repo
https://github.com/parse-community/parse-sdk-js
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
00973987f361368659c0c4dbf669f3897520b132
Type
GIT
Repo
https://github.com/parse-community/parse-sdk-js
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7a5f2ff5b9ddd32f022ae8f58b6feb26c2cc793e

Affected versions

2.*
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.2.1
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.6.0
2.7.0
2.7.1
2.8.0
2.9.0
2.9.1
3.*
3.0.0
3.1.0
3.2.0
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.5.0
3.5.1
4.*
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
4.3.1
5.*
5.0.0
5.1.0
5.2.0
5.3.0
6.*
6.0.0
6.1.0
6.1.1
6.2.0-alpha.1
6.2.0-alpha.2
6.2.0-alpha.3
v1.*
v1.10.0
v1.11.0
v1.11.1
v1.6.11
v1.6.12
v1.6.13
v1.6.14
v1.6.4
v1.6.6
v1.6.7
v1.6.8
v1.6.9
v1.7.0
v1.7.0-rc1
v1.7.1
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.9.1
v1.9.2
v2.*
v2.0.0
v2.0.1
v2.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62374.json"