Remote Code Execution Flaw in jsonpath-plus Affects JSONPath-Plus Library by JSONPath-Plus
CVE-2025-1302
Key Information:
- Vendor
JSONPath-Plus
- Status
- Vendor
- CVE Published:
- 15 February 2025
Badges
What is CVE-2025-1302?
Versions of the jsonpath-plus library prior to 10.3.0 are susceptible to a Remote Code Execution vulnerability stemming from inadequate input sanitization practices. This issue arises when the 'eval' option is set to 'safe' mode, allowing potential attackers to execute arbitrary code on the affected systems. The problem is linked to an incomplete resolution from a previous vulnerability, underscoring the need for immediate updating to safeguard applications utilizing this library.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
jsonpath-plus 0 < 10.3.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
EPSS Score
85% chance of being exploited in the next 30 days.
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved