CVE-2025-1302

CVSS 9.3 CRITICALEPSS 10.7%CWE-94

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Affected products

n/a · jsonpath-plus

public PoCs found — 2

githubgithub.com/EQSTLab/CVE-2025-1302★ 21 githubgithub.com/abrewer251/CVE-2025-1302_jsonpath-plus_RCE★ 1

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456 https://github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js%23L127 https://github.com/JSONPath-Plus/JSONPath/commit/30942896d27cb8a806b965a5ca9ef9f686be24ee https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-8719585