JSONPath Plus allows Remote Code Execution

CRITICAL 9.8CVE-2025-1302 · GHSA-hw8r-x6gr-5gjp · Published 15/02/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
jsonpath-plus npm	`< 10.3.0`	`10.3.0`

Description

Note:

This is caused by an incomplete fix for CVE-2024-21534.

NVD description

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).

References

nvd.nist.gov/vuln/detail/CVE-2024-21534 · ADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-1302 · ADVISORY
JSONPath-Plus/JSONPath commit 3094289 · WEB
gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456 · WEB
JSONPath-Plus/JSONPath · PACKAGE
JSONPath-Plus/JSONPath · WEB
security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-8719585 · WEB
JSONPath-Plus/JSONPath

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free