Vulnerability · Published Feb 15, 2025 · Assigned by snyk
CVE-2025-1302
Critical 9.8
In plain English
A critical-severity code injection in jsonpath-plus. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 10.4% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | jsonpath-plus | 10.3.0 | GHSA-hw8r-x6gr-5gjp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | jsonpath-plus | 0 – before 10.3.0 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
References
- https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-8719585
- https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456
- https://github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js%23L127
- https://github.com/JSONPath-Plus/JSONPath/commit/30942896d27cb8a806b965a5ca9ef9f686be24ee