Description
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.

**Note:**

This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).
Published: 2025-02-15
Score: 9.3 Critical
EPSS: 89.1% High
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-hw8r-x6gr-5gjp JSONPath Plus allows Remote Code Execution
History

Tue, 15 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.30822}

 epss

{'score': 0.32942}

Mon, 14 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.34846}

 epss

{'score': 0.30822}

Tue, 18 Feb 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 18 Feb 2025 02:15:00 +0000

Type Values Removed Values Added
Title jsonpath-plus: Remote Code Execution in jsonpath-plus via Improper Input Sanitization
References
Metrics threat_severity

None

 threat_severity

Low

Sat, 15 Feb 2025 05:15:00 +0000

Type Values Removed Values Added
Description Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: snyk

Published:

Updated: 2025-02-18T20:32:41.833Z

Reserved: 2025-02-14T13:41:24.175Z

Link: CVE-2025-1302

cve-icon Vulnrichment

Updated: 2025-02-18T20:32:35.560Z

cve-icon NVD

Status : Deferred

Published: 2025-02-15T05:15:11.683

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-1302

cve-icon Redhat

Severity : Low

Publid Date: 2025-02-15T05:00:01Z

Links: CVE-2025-1302 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses