CVE-2024-21534
1 advisory.
npm/jsonpath-plus CVE-2024-21534: critical 9.8, EPSS 9.02%
JSONPath Plus Remote Code Execution (RCE) Vulnerability
Action: Upgrade jsonpath-plus to 10.2.0 or later.
npm i jsonpath-plus@10.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 10.2.0 | - |
Fixed versions
| 10.2.0 |
Sources
- osv: GHSA-pppg-cpfq-h7wr
- https://nvd.nist.gov/vuln/detail/CVE-2024-21534
- https://github.com/JSONPath-Plus/JSONPath/issues/226
- https://github.com/JSONPath-Plus/JSONPath/issues/226#issuecomment-2424230316
- https://github.com/JSONPath-Plus/JSONPath/pull/233
- https://github.com/JSONPath-Plus/JSONPath/commit/6b2f1b4c234292c75912b790bf7e2d7339d4ccd3
- https://github.com/JSONPath-Plus/JSONPath/commit/73ad72e5ee788d8287dea6e8283a3f16f63c9eb8
- https://github.com/JSONPath-Plus/JSONPath/commit/b70aa713553caf838a63bac923195a5bc541fd72
- https://github.com/JSONPath-Plus/JSONPath
- https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8185019
- https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884
CVE-2024-21534 · published · modified · JSON