Most recent entries from all

EUVD-2026-254954

2026-10-15T15:09:37.244164+00:00

EUVD-2026-254954

fkie_cve-2025-62374

2026-10-15T15:09:37.244200+00:00

Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0.

GHSA-9f2h-7v79-mxw3 — Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs

2026-10-15T15:09:37.244236+00:00

Affected: npm: parse

### Summary

Prototype pollution capabilities on various APIs.

### Details

Injection of malicious payload allows attacker to remotely execute arbitrary code. `Parse.Object` and internal APIs are affected, specifically: - `ParseObject.fromJSON` - `ParseObject.pin` - `ParseObject.registerSubclass` - `ObjectStateMutations` (internal) - `encode`/`decode` (internal)

### PoC

Demonstrative tests added as part of the fix.

### References

- https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-9f2h-7v79-mxw3 - Patch https://github.com/parse-community/Parse-SDK-JS/releases/tag/7.0.0-alpha.1