VDB
Sign up
CRITICAL9.8

GHSA-pppg-cpfq-h7wr

JSONPath Plus Remote Code Execution (RCE) Vulnerability

Quick fix

GHSA-pppg-cpfq-h7wr — jsonpath-plus: upgrade to the fixed version with the command below.

npm install jsonpath-plus@10.2.0

Details

Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.

**Note:**

There were several attempts to fix it in versions [10.0.0-10.1.0](https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0) but it could still be exploited using [different payloads](https://github.com/JSONPath-Plus/JSONPath/issues/226)

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/jsonpath-plus
Introduced in: 0Fixed in: 10.2.0
Fixnpm install jsonpath-plus@10.2.0
Maven/org.webjars.npm:jsonpath-plus
Introduced in: 0

No fixed version published yet for org.webjars.npm:jsonpath-plus (maven). Pin to a known-safe version or switch to an alternative.

References