Skip to content

Product

npm jsonpath-plus vulnerabilities

2 published CVES affecting npm jsonpath-plus, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
2
High
0
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest npm jsonpath-plus CVEs

Newest publication first

  1. CVE-2025-1302 JSONPath Plus allows Remote Code Execution

    Published
    CriticalCVSS 9.3 EPSS 10.4%

    Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incom...

  2. CVE-2024-21534 JSONPath Plus Remote Code Execution (RCE) Vulnerability

    Published
    CriticalCVSS 9.8 EPSS 9.0%

    All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. Note: There were several attempts to fix it in v...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.