Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs

中危 6.4CVE-2025-62374 · GHSA-9f2h-7v79-mxw3 · Published 14/10/2025 · updated 08/10/2026

要点

CVE-2025-62374 是影响 parse 的中危 (CVSS 6.4)漏洞。
未来 30 天内被利用的概率（EPSS）：0.41%，高于 35.3% 的漏洞。
修复：升级到 7.0.0 或更高版本。

Package	Affected versions	Patched versions
parse npm	`< 7.0.0`	`7.0.0`

Description

Summary

Prototype pollution capabilities on various APIs.

Details

Injection of malicious payload allows attacker to remotely execute arbitrary code. Parse.Object and internal APIs are affected, specifically:

ParseObject.fromJSON
ParseObject.pin
ParseObject.registerSubclass
ObjectStateMutations (internal)
encode/decode (internal)

PoC

Demonstrative tests added as part of the fix.

References

NVD description

Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0.

References

parse-community/Parse-SDK-JS security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-62374 · ADVISORY
parse-community/Parse-SDK-JS#2749 · WEB
parse-community/Parse-SDK-JS commit 0097398 · WEB
parse-community/Parse-SDK-JS · PACKAGE
parse-community/Parse-SDK-JS release 7.0.0-alpha.1 · WEB

parse 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

parse

npm

< 7.0.0

7.0.0

Description

Summary

Prototype pollution capabilities on various APIs.

Details

Injection of malicious payload allows attacker to remotely execute arbitrary code. Parse.Object and internal APIs are affected, specifically:

ParseObject.fromJSON
ParseObject.pin
ParseObject.registerSubclass
ObjectStateMutations (internal)
encode/decode (internal)

PoC

Demonstrative tests added as part of the fix.

References

NVD description