PT-2024-18948 · Unknown · Jsonpath-Plus

Andrea Angelo Raineri

·

Published

2024-10-10

·

Updated

2026-02-23

·

CVE-2024-21534

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions jsonpath-plus versions prior to 10.0.7
Description The issue is related to Remote Code Execution (RCE) due to improper input sanitization, allowing an attacker to execute arbitrary code on the system by exploiting the unsafe default usage of vm in Node. There were attempts to fix it in versions 10.0.0-10.1.0, but it could still be exploited using different payloads.
Recommendations For jsonpath-plus versions prior to 10.0.7, update to version 10.0.7 or later to resolve the issue. As a temporary workaround, consider disabling the use of vm in Node until a patch is available. Restrict access to the vulnerable package to minimize the risk of exploitation. Avoid using the vulnerable package in production environments until the issue is resolved.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-21534
GHSA-HW8R-X6GR-5GJP
GHSA-PPPG-CPFQ-H7WR

Affected Products

Jsonpath-Plus