Prototype pollution in Parse SDK js - CVE-2025-62374
Published: October 17, 2025
Vulnerability identifier: #VU117338
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-62374
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript code.
The vulnerability exists due to improper input validation in ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass,
ObjectStateMutations (internal), and encode/decode (internal) methods. A remote user can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.
Affected software
Parse SDK js
How to mitigate CVE-2025-62374
Install updates from vendor's website.
Parse SDK js - update to 7.0.0