npm/jsonpath-plus CVE-2025-1302: critical 9.8, EPSS 10.39%
JSONPath Plus allows Remote Code Execution
Action: Upgrade jsonpath-plus to 10.3.0 or later.
npm i jsonpath-plus@10.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 10.3.0 | - |
Fixed versions
| 10.3.0 |
Sources
- osv: GHSA-hw8r-x6gr-5gjp
- https://nvd.nist.gov/vuln/detail/CVE-2024-21534
- https://nvd.nist.gov/vuln/detail/CVE-2025-1302
- https://github.com/JSONPath-Plus/JSONPath/commit/30942896d27cb8a806b965a5ca9ef9f686be24ee
- https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456
- https://github.com/JSONPath-Plus/JSONPath
- https://github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js#L127
- https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-8719585
CVE-2025-1302 · published · modified · JSON