CVE-2025-1302

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-02-15 · updated 2026-06-17
Weakness: CWE-94

Description

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).

Affected products

jsonpath-plus: before 10.3.0 — fixed in 10.3.0

How to fix

Upgrade to a fixed version: jsonpath-plus 10.3.0. Check the vendor advisory for mitigations.

References

https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456
https://github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js%23L127
https://github.com/JSONPath-Plus/JSONPath/commit/30942896d27cb8a806b965a5ca9ef9f686be24ee
https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-8719585

Get alerted when CVE-2025-1302 or the next vulnerability affects your stack