Homepage

jsonpath-plus@5.1.0 vulnerabilities

A JS implementation of JSONPath with some additional operators

  • latest version

    10.3.0

  • latest non vulnerable version

    10.3.0

  • first published

    9 years ago

  • latest version published

    1 months ago

  • licenses detected

  • View jsonpath-plus package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the jsonpath-plus package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Remote Code Execution (RCE)

    jsonpath-plus is an A JS implementation of JSONPath with some additional operators

    Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.

    Note:

    This is caused by an incomplete fix for CVE-2024-21534.

    How to fix Remote Code Execution (RCE)?

    Upgrade jsonpath-plus to version 10.3.0 or higher.

    <10.3.0
    • C
    Remote Code Execution (RCE)

    jsonpath-plus is an A JS implementation of JSONPath with some additional operators

    Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.

    Note:

    There were several attempts to fix it in versions 10.0.0-10.1.0 but it could still be exploited using different payloads.

    How to fix Remote Code Execution (RCE)?

    Upgrade jsonpath-plus to version 10.2.0 or higher.

    <10.2.0
    Go back to all versions of this package