CVE-2025-1302

CVSS 9.3 CRITICALEPSS 10.7%CWE-94

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Productos afectados

n/a · jsonpath-plus

PoCs públicas encontradas — 2

githubgithub.com/EQSTLab/CVE-2025-1302★ 21 githubgithub.com/abrewer251/CVE-2025-1302_jsonpath-plus_RCE★ 1

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456 https://github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js%23L127 https://github.com/JSONPath-Plus/JSONPath/commit/30942896d27cb8a806b965a5ca9ef9f686be24ee https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-8719585