PT-2025-42196 · Parse · Parse Javascript Sdk

Published 2025-10-14 · Updated 2025-10-16 · CVE-2025-62374

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Parse Javascript SDK versions prior to 7.0.0

Description A flaw exists in Parse Javascript SDK that, before version 7.0.0, allows for remote code execution through the injection of malicious payloads. The following components are impacted: ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal).

Recommendations Update to version 7.0.0 or later.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-62374

GHSA-9F2H-7V79-MXW3

Affected Products

Parse Javascript Sdk

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62374.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-62374 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9f2h-7v79-mxw3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62374 · Security Note
• https://github.com/parse-community/Parse-SDK-JS · Note
• https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-9f2h-7v79-mxw3 · Note
• https://github.com/parse-community/Parse-SDK-JS/releases/tag/7.0.0-alpha.1 · Note
• https://github.com/parse-community/Parse-SDK-JS/commit/00973987f361368659c0c4dbf669f3897520b132 · Note
• https://github.com/parse-community/Parse-SDK-JS/pull/2749 · Note
• https://t.me/CVEtracker/34907 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1o7bmsg/resumen_diario_de_vulnerabilidades_15102025 · Reddit Post
• https://twitter.com/CVEnew/status/1978198198003831282 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o87w9u/resumen_diario_de_vulnerabilidades_16102025 · Reddit Post