{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"6.0.1"}],"component":"org.webjars.npm:jsonpath-plus","cve_ids":["CVE-2024-21534"],"ecosystem":"Maven","epss":0.09017,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-pppg-cpfq-h7wr","id":"tcs_01M5N97T3DQVZQAVFNB9WFDW4F","modified_at":"2026-09-10T03:50:19.926738130Z","published_at":"2024-10-11T15:30:32Z","references":["https://osv.dev/vulnerability/GHSA-pppg-cpfq-h7wr","https://nvd.nist.gov/vuln/detail/CVE-2024-21534","https://github.com/JSONPath-Plus/JSONPath/issues/226","https://github.com/JSONPath-Plus/JSONPath/issues/226#issuecomment-2424230316","https://github.com/JSONPath-Plus/JSONPath/pull/233","https://github.com/JSONPath-Plus/JSONPath/commit/6b2f1b4c234292c75912b790bf7e2d7339d4ccd3","https://github.com/JSONPath-Plus/JSONPath/commit/73ad72e5ee788d8287dea6e8283a3f16f63c9eb8","https://github.com/JSONPath-Plus/JSONPath/commit/b70aa713553caf838a63bac923195a5bc541fd72","https://github.com/JSONPath-Plus/JSONPath","https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8185019","https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-pppg-cpfq-h7wr#Maven/org.webjars.npm:jsonpath-plus","url":"https://osv.dev/vulnerability/GHSA-pppg-cpfq-h7wr"}],"summary":"JSONPath Plus Remote Code Execution (RCE) Vulnerability"}