GHSA-hw8r-x6gr-5gjp
JSONPath Plus allows Remote Code Execution
At a glance
- Published
- Updated
- CVE
- CVE-2025-1302
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Description
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for CVE-2024-21534.
Affected packages
| Package | Versions |
|---|---|
| npm · jsonpath-plus | introduced 0, fixed 10.3.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-21534 ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2025-1302 ADVISORY
- https://github.com/JSONPath-Plus/JSONPath/commit/30942896d27cb8a806b965a5ca9ef9f686be24ee WEB
- https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456 WEB
- https://github.com/JSONPath-Plus/JSONPath PACKAGE
- https://github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js#L127 WEB
- https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-8719585 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |