critical9.8
CVE-2025-1302
JSONPath Plus allows Remote Code Execution
Impact
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for CVE-2024-21534.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | jsonpath-plus | < 10.3.0 | 10.3.0 |
Affected products
| Product | Affected versions |
|---|---|
| Package Jsonpath-Plus | before 10.3.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456
- https://github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js%23L127
- https://github.com/JSONPath-Plus/JSONPath/commit/30942896d27cb8a806b965a5ca9ef9f686be24ee
- https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-8719585
- https://github.com/advisories/GHSA-hw8r-x6gr-5gjp
- https://nvd.nist.gov/vuln/detail/CVE-2025-1302
- https://nvd.nist.gov/vuln/detail/CVE-2024-21534
- https://github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js#L127