Executive brief
Parse is a popular backend-as-a-service platform used to build web and mobile applications. A prototype pollution vulnerability in the JavaScript SDK allows an authenticated attacker to inject malicious payloads that can leak sensitive data or cause service disruption. This could expose customer data stored in Parse applications or disrupt their operation.
Technical details
This is a prototype pollution vulnerability (CWE-1321) affecting multiple Parse SDK APIs including `Parse.Object.fromJSON()`, `Parse.Object.pin()`, `Parse.Object.registerSubclass()`, internal `ObjectStateMutations`, and the `encode`/`decode` functions. The vulnerability allows an attacker with low privileges to craft a malicious payload that pollutes the JavaScript object prototype through these APIs. Attack requires network access and low-privilege authentication but no user interaction. Successful exploitation can lead to arbitrary code execution, information disclosure, and service availability loss. The vulnerability is fixed in version 7.0.0 and later.
Affected products
- Parse Community Parse JavaScript SDK <7.0.0
Timeline
- 2025-10-14: disclosed
- 2025-10-14: patched: Fixed in version 7.0.0