GitHub Advisoryadvisory · npm

GHSA-hw8r-x6gr-5gjp JSONPath Plus allows Remote Code Execution

HIGH Published 2025-02-15 Modified 2025-02-18 Official page ↗
Aliases
CVE-2025-1302
Ecosystem
npm
Packages
jsonpath-plus
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2025-02-18

Affected packages

• npm jsonpath-plus: < 10.3.0 → fixed in 10.3.0

Description

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for CVE-2024-21534.

Related

Alias · CVE (1)

  • CVE-2025-1302 Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References