GitHub Advisoryadvisory · npm, Maven

GHSA-pppg-cpfq-h7wr JSONPath Plus Remote Code Execution (RCE) Vulnerability

CRITICAL Published 2024-10-11 Modified 2025-02-06 Official page ↗
Aliases
CVE-2024-21534
Ecosystem
npm, Maven
Packages
jsonpath-plus, org.webjars.npm:jsonpath-plus
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2024-10-14

Affected packages

• npm jsonpath-plus: < 10.2.0 → fixed in 10.2.0 • Maven org.webjars.npm:jsonpath-plus: <= 6.0.1 (no fix yet)

Description

Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. Note: There were several attempts to fix it in versions 10.0.0-10.1.0 but it could still be exploited using different payloads

Related

Alias · CVE (1)

  • CVE-2024-21534 All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References