CyberSecBulletin

Jsonpath-plus vulnerabilities

We track 2 vulnerabilities in Jsonpath-plus products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on February 15, 2025.

2vulnerabilities
2critical
0high
0exploited
9.8average CVSS score

Latest Jsonpath-plus vulnerabilities

  • 9.8 Critical severity

    jsonpath-plus: Improper Control of Generation of Code

    CVE-2025-1302Jsonpath-plusEPSS 10.4%

    Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** Th

  • 9.8 Critical severity

    jsonpath-plus: Improper Control of Generation of Code

    CVE-2024-21534Jsonpath-plusEPSS 9.02%

    All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. **Note:** There were several