CVE-2025-62374: Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs

The vulnerability is a classic prototype pollution issue in the Parse Javascript SDK. The root cause is the improper handling of object keys in several parts of the codebase, which allowed an attacker to modify the Object.prototype by using malicious keys like __proto__, constructor, or prototype.

The analysis of the patch commit 00973987f361368659c0c4dbf669f3897520b132 reveals that the fix involves two main strategies:

1. Introducing a new function isDangerousKey to explicitly check for and block malicious keys.
2. Changing the creation of internal objects from {} to Object.create(null) to prevent access to the Object.prototype.

The vulnerable functions were identified by locating where these fixes were applied. The core of the vulnerability lies in the internal decode, encode, and ObjectStateMutations modules, which were responsible for handling object data without proper validation. These internal vulnerabilities were then exposed through the public API of ParseObject, specifically in functions like fromJSON, registerSubclass, and pin, as stated in the security advisory.

The identified functions are the ones that would appear in a runtime profile when the vulnerability is triggered. An attacker would craft a malicious object and pass it to one of these functions, causing the prototype pollution to occur within the execution of that function.