GitHub Advisoryadvisory · Maven

GHSA-5x5q-8cgm-2hjq Karate has vulnerable dependency on json-smart package (CVE-2023-1370)

HIGH Published 2023-03-31 Modified 2025-01-07 Official page ↗

Ecosystem: Maven
Packages: com.intuit.karate:karate-core
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-674
Reviewed: 2023-03-31

Affected packages

• Maven com.intuit.karate:karate-core: >= 1.3.1, < 1.4.0 → fixed in 1.4.0

Description

Summary The CVE How to fix it Very simple, just upgrade json-path package to 2.8.0 (from 2.7.0) inside karate-core pom.xml ;)

Related

Weakness · CWE (1)

CWE-674 Uncontrolled Recursion weakness

References