CVE-2025-62374

6.4 MEDIUM
Published: October 14, 2025 Modified: October 16, 2025
View on NVD

Description

Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/parse-community/Parse-SDK-JS/commit/00973987f361368659c0c4dbf669f3897520b132
Source: security-advisories@github.com
https://github.com/parse-community/Parse-SDK-JS/pull/2749
Source: security-advisories@github.com
https://github.com/parse-community/Parse-SDK-JS/releases/tag/7.0.0-alpha.1
Source: security-advisories@github.com
https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-9f2h-7v79-mxw3
Source: security-advisories@github.com

4 reference(s) from NVD

Quick Stats

CVSS v3 Score
6.4 / 10.0
EPSS (Exploit Probability)
0.1%
29th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-1321

Related CVEs

CVE-2025-69261 N/A
CVE-2025-69257 6.7
CVE-2025-69210 N/A
CVE-2025-66823 N/A
CVE-2025-50343 N/A