CVE-2025-62374: Parse JavaScript SDK prototype pollution in Parse.Object

CVE-2025-62374 · Severity: medium · CVSS 6.4 · Published 2025-10-14

Parse is a popular backend-as-a-service platform used to build web and mobile applications. A prototype pollution vulnerability in the JavaScript SDK allows an authenticated attacker to inject malicious payloads that can leak sensitive data or cause service disruption. This could expose customer data stored in Parse applications or disrupt their operation.

Technologies: parse (npm). Vendors: npm, Parse Community.

Quick answers

Is CVE-2025-62374 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-62374 being exploited in the wild.
How severe is CVE-2025-62374?
Medium severity, with a CVSS score of 6.4, published 14 October 2025.
Which products and versions are affected?
parse (npm) SEMVER:introduced=0,fixed=7.0.0; Parse Community Parse JavaScript SDK <7.0.0.
Is there a fix for CVE-2025-62374?
Yes. parse (npm): upgrade to 7.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-62374 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-62374?
Check whether you run parse (npm) or Parse Community Parse JavaScript SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • parse (npm): upgrade to 7.0.0 or later
    npm install parse@7.0.0

Technical details

This is a prototype pollution vulnerability (CWE-1321) affecting multiple Parse SDK APIs including `Parse.Object.fromJSON()`, `Parse.Object.pin()`, `Parse.Object.registerSubclass()`, internal `ObjectStateMutations`, and the `encode`/`decode` functions. The vulnerability allows an attacker with low privileges to craft a malicious payload that pollutes the JavaScript object prototype through these APIs. Attack requires network access and low-privilege authentication but no user interaction. Successful exploitation can lead to arbitrary code execution, information disclosure, and service availability loss. The vulnerability is fixed in version 7.0.0 and later.

Affected products

  • Parse Community Parse JavaScript SDK <7.0.0

Identifiers

  • CVE-2025-62374
  • GHSA-9f2h-7v79-mxw3

Timeline

  • 2025-10-14: disclosed
  • 2025-10-14: patched: Fixed in version 7.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.