parse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeState function of parse version 5.3.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.
References
Configurations
History
16 Oct 2025, 15:48
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Parseplatform parse Javascript Sdk
Parseplatform |
|
| CPE | cpe:2.3:a:parseplatform:parse_javascript_sdk:*:*:*:*:*:*:*:* | |
| References | () https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/parse%405.3.0/index.js - Broken Link | |
| References | () https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57324 - Third Party Advisory |
25 Sep 2025, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | CWE-1321 |
24 Sep 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-24 21:15
Updated : 2025-10-16 15:48
NVD link : CVE-2025-57324
Mitre link : CVE-2025-57324
CVE.ORG link : CVE-2025-57324
JSON object : View
Products Affected
parseplatform
- parse_javascript_sdk
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')