parse is vulnerable to prototype pollution

MEDIUM 6.5CVE-2025-57324 · GHSA-9g8m-v378-pcg3 · Published 24/09/2025 · updated 17/06/2026

In short

CVE-2025-57324 is a MEDIUM (CVSS 6.5) vulnerability affecting parse javascript sdk (parseplatform), parse.
Chance of exploitation in the next 30 days (EPSS): 0.36%, higher than 29.6% of all vulnerabilities.
Fix: update to 7.0.0-alpha.1 or later.

Package	Affected versions	Patched versions
parse javascript sdk parseplatform	`≤ 5.3.0`	No fix yet
parse npm	`< 7.0.0-alpha.1`	`7.0.0-alpha.1`

Description

parse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeState function of parse allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.

NVD description

parse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeState function of parse version 5.3.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.

References

nvd.nist.gov/vuln/detail/CVE-2025-57324 · ADVISORY
parse-community/Parse-SDK-JS commit 9e7c1ba · WEB
VulnSageAgent/PoCs · WEB
VulnSageAgent/PoCs · WEB
parse-community/Parse-SDK-JS · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free