CVE-2025-62374: falha de média gravidade em parse-community Parse-SDK-JS
Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.4epss 0.4%
Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
Produtos afetados
parse-community · Parse-SDK-JSReferências
https://github.com/parse-community/Parse-SDK-JS/commit/00973987f361368659c0c4dbf669f3897520b132https://github.com/parse-community/Parse-SDK-JS/pull/2749https://github.com/parse-community/Parse-SDK-JS/releases/tag/7.0.0-alpha.1https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-9f2h-7v79-mxw3