AIKIDO-2024-10345
jsonpath-plus is vulnerable to Remote Code Execution (RCE)
90
Critical Risk
This Affects:
jsonpath-plusTL;DR
Affected versions of the package remain vulnerable to Remote Code Execution (RCE). CVE-2024-21534 was not fully addressed in version 10.0.0, leaving the possibility of RCE for certain inputs.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
jsonpath-plus is vulnerable to Remote Code Execution (RCE) in versions 0.1.0 - 10.1.0.
How to fix this
Upgrade the jsonpath-plus library to the patch version.
Links
Related Issue
Other
github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0
security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8185019security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.