{"action":"Upgrade jsonpath-plus to 10.3.0 or later.","affected":[{"fixed":"10.3.0","introduced":"0"}],"component":"jsonpath-plus","cve_ids":["CVE-2025-1302"],"ecosystem":"npm","epss":0.10395,"exploited":false,"fixed_versions":["10.3.0"],"ghsa_id":"GHSA-hw8r-x6gr-5gjp","id":"tcs_01M5KFW7F039WYERTQJB1DMVPD","modified_at":"2026-09-10T03:50:22.730047338Z","published_at":"2025-02-15T06:30:51Z","references":["https://osv.dev/vulnerability/GHSA-hw8r-x6gr-5gjp","https://nvd.nist.gov/vuln/detail/CVE-2024-21534","https://nvd.nist.gov/vuln/detail/CVE-2025-1302","https://github.com/JSONPath-Plus/JSONPath/commit/30942896d27cb8a806b965a5ca9ef9f686be24ee","https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456","https://github.com/JSONPath-Plus/JSONPath","https://github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js#L127","https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-8719585"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-hw8r-x6gr-5gjp","url":"https://osv.dev/vulnerability/GHSA-hw8r-x6gr-5gjp"}],"summary":"JSONPath Plus allows Remote Code Execution"}