CVE-2024-21534

Description

All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. **Note:** There were several attempts to fix it in versions [10.0.0-10.1.0](https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0) but it could still be exploited using [different payloads](https://github.com/JSONPath-Plus/JSONPath/issues/226).

Reserved 2023-12-22 | Published 2024-10-11 | Updated 2024-11-18 | Assigner snyk

Problem types

Remote Code Execution (RCE)

Product status

Any version before *
affected

Any version before *
affected

Credits

Andrea Angelo Raineri

References

security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884

security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8185019

github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0

github.com/JSONPath-Plus/JSONPath/issues/226

cve.org (CVE-2024-21534)

nvd.nist.gov (CVE-2024-21534)

Download JSON