Executive brief
JSONPath Plus is a JavaScript library used to query and manipulate JSON data structures in applications. Due to improper input sanitization, an attacker can execute arbitrary code on systems using vulnerable versions, potentially compromising the entire application and its underlying infrastructure.
Technical details
This vulnerability is a Remote Code Execution (RCE) flaw in jsonpath-plus before version 10.3.0, caused by improper input sanitization and an incomplete fix for CVE-2024-21534. The unsafe default usage of eval='safe' mode allows an attacker to bypass the intended security restrictions and execute arbitrary code. An attacker with network access can exploit this without authentication or user interaction to achieve complete system compromise. The vulnerability is classified as CWE-94 (improper control of generation of code). A fix is available in version 10.3.0 and later.
Affected products
- JSONPath-Plus jsonpath-plus before 10.3.0
Timeline
- 2025-02-15: disclosed
- 2025-02-15: patched: Fix available in version 10.3.0