CVE-2025-57324
MEDIUMParseplatform Parse Javascript SDK < 5.3.0 - Prototype Pollution
Title source: ruleDescription
parse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeState function of parse version 5.3.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.
Scores
CVSS v3
6.5
EPSS
0.0015
EPSS Percentile
35.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-1321
Status
published
Products (2)
npm/parse
0 - 7.0.0-alpha.1npm
parseplatform/parse_javascript_sdk
< 5.3.0
Published
Sep 24, 2025
Tracked Since
Feb 18, 2026