Maven/org.webjars.npm:jsonpath-plus CVE-2024-21534: critical 9.8, EPSS 9.02%
JSONPath Plus Remote Code Execution (RCE) Vulnerability
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 6.0.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-pppg-cpfq-h7wr#Maven/org.webjars.npm:jsonpath-plus
- https://nvd.nist.gov/vuln/detail/CVE-2024-21534
- https://github.com/JSONPath-Plus/JSONPath/issues/226
- https://github.com/JSONPath-Plus/JSONPath/issues/226#issuecomment-2424230316
- https://github.com/JSONPath-Plus/JSONPath/pull/233
- https://github.com/JSONPath-Plus/JSONPath/commit/6b2f1b4c234292c75912b790bf7e2d7339d4ccd3
- https://github.com/JSONPath-Plus/JSONPath/commit/73ad72e5ee788d8287dea6e8283a3f16f63c9eb8
- https://github.com/JSONPath-Plus/JSONPath/commit/b70aa713553caf838a63bac923195a5bc541fd72
- https://github.com/JSONPath-Plus/JSONPath
- https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8185019
- https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884
CVE-2024-21534 · published · modified · JSON