{"action":"Upgrade jsonpath-plus to 10.2.0 or later.","affected":[{"fixed":"10.2.0","introduced":"0"}],"component":"jsonpath-plus","cve_ids":["CVE-2024-21534"],"ecosystem":"npm","epss":0.09017,"exploited":false,"fixed_versions":["10.2.0"],"ghsa_id":"GHSA-pppg-cpfq-h7wr","id":"tcs_01M5KG45ECF2BRF5CKZER49KRX","modified_at":"2026-09-10T03:50:19.926738130Z","published_at":"2024-10-11T15:30:32Z","references":["https://osv.dev/vulnerability/GHSA-pppg-cpfq-h7wr","https://nvd.nist.gov/vuln/detail/CVE-2024-21534","https://github.com/JSONPath-Plus/JSONPath/issues/226","https://github.com/JSONPath-Plus/JSONPath/issues/226#issuecomment-2424230316","https://github.com/JSONPath-Plus/JSONPath/pull/233","https://github.com/JSONPath-Plus/JSONPath/commit/6b2f1b4c234292c75912b790bf7e2d7339d4ccd3","https://github.com/JSONPath-Plus/JSONPath/commit/73ad72e5ee788d8287dea6e8283a3f16f63c9eb8","https://github.com/JSONPath-Plus/JSONPath/commit/b70aa713553caf838a63bac923195a5bc541fd72","https://github.com/JSONPath-Plus/JSONPath","https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8185019","https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-pppg-cpfq-h7wr","url":"https://osv.dev/vulnerability/GHSA-pppg-cpfq-h7wr"}],"summary":"JSONPath Plus Remote Code Execution (RCE) Vulnerability"}