GHSA-pppg-cpfq-h7wr
JSONPath Plus Remote Code Execution (RCE) Vulnerability
Quick fix
GHSA-pppg-cpfq-h7wr — jsonpath-plus: upgrade to the fixed version with the command below.
npm install jsonpath-plus@10.2.0Details
Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.
**Note:**
There were several attempts to fix it in versions [10.0.0-10.1.0](https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0) but it could still be exploited using [different payloads](https://github.com/JSONPath-Plus/JSONPath/issues/226)
Are you affected?
Enter the version of the package you're using.
Affected packages
0No fixed version published yet for org.webjars.npm:jsonpath-plus (maven). Pin to a known-safe version or switch to an alternative.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-21534[ADVISORY]
- https://github.com/JSONPath-Plus/JSONPath/issues/226[WEB]
- https://github.com/JSONPath-Plus/JSONPath/issues/226#issuecomment-2424230316[WEB]
- https://github.com/JSONPath-Plus/JSONPath/pull/233[WEB]
- https://github.com/JSONPath-Plus/JSONPath/commit/6b2f1b4c234292c75912b790bf7e2d7339d4ccd3[WEB]
- https://github.com/JSONPath-Plus/JSONPath/commit/73ad72e5ee788d8287dea6e8283a3f16f63c9eb8[WEB]
- https://github.com/JSONPath-Plus/JSONPath/commit/b70aa713553caf838a63bac923195a5bc541fd72[WEB]
- https://github.com/JSONPath-Plus/JSONPath[PACKAGE]
- https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0[WEB]
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8185019[WEB]
- https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884[WEB]