Is CVE-2025-1302 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-1302 being exploited in the wild.

How severe is CVE-2025-1302?

Low severity, with a CVSS score of 3.1, published 15 February 2025.

Which products and versions are affected?

jsonpath-plus (npm) SEMVER:introduced=0,fixed=10.3.0.

Is there a fix for CVE-2025-1302?

Yes. jsonpath-plus (npm): upgrade to 10.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-1302 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-1302?

Check whether you run jsonpath-plus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-1302: JSONPath Plus remote code execution

CVE-2025-1302 · Severity: low · CVSS 3.1 · Published 2025-02-15

JSONPath Plus is a JavaScript library used to query and manipulate JSON data structures in applications. Due to improper input sanitization, an attacker can execute arbitrary code on systems using vulnerable versions, potentially compromising the entire application and its underlying infrastructure.

Vendors: npm.

Quick answers

Is CVE-2025-1302 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-1302 being exploited in the wild.
How severe is CVE-2025-1302?: Low severity, with a CVSS score of 3.1, published 15 February 2025.
Which products and versions are affected?: jsonpath-plus (npm) SEMVER:introduced=0,fixed=10.3.0.
Is there a fix for CVE-2025-1302?: Yes. jsonpath-plus (npm): upgrade to 10.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-1302 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-1302?: Check whether you run jsonpath-plus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jsonpath-plus (npm): upgrade to 10.3.0 or later
```
npm install jsonpath-plus@10.3.0
```

Technical details

This vulnerability is a Remote Code Execution (RCE) flaw in jsonpath-plus before version 10.3.0, caused by improper input sanitization and an incomplete fix for CVE-2024-21534. The unsafe default usage of eval='safe' mode allows an attacker to bypass the intended security restrictions and execute arbitrary code. An attacker with network access can exploit this without authentication or user interaction to achieve complete system compromise. The vulnerability is classified as CWE-94 (improper control of generation of code). A fix is available in version 10.3.0 and later.

Affected products

JSONPath-Plus jsonpath-plus before 10.3.0

Identifiers

CVE-2025-1302
GHSA-hw8r-x6gr-5gjp

Timeline

2025-02-15: disclosed
2025-02-15: patched: Fix available in version 10.3.0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.