Red Hat CVE-2025-1302
HIGHSeverity by source
Sources disagree (Low–Critical)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3Blast Radius
ecosystem impact- 562 npm packages depend on jsonpath-plus (42 direct, 521 indirect)
Ecosystem-wide dependent count for version 10.3.0.
DescriptionCVE.org
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for CVE-2024-21534.
AnalysisAI
The jsonpath-plus npm package before version 10.3.0 contains a remote code execution vulnerability due to improper input sanitization in the eval='safe' mode. Despite being labeled 'safe', the evaluation mode allows attackers to escape the sandbox and execute arbitrary JavaScript, affecting any application processing untrusted JSONPath expressions.
Technical ContextAI
jsonpath-plus provides JSONPath query capabilities for JavaScript applications. The eval='safe' mode was intended to provide sandboxed expression evaluation but fails to properly restrict the execution context. An attacker can craft a JSONPath expression that breaks out of the sandbox using constructor chain techniques (e.g., this.constructor.constructor('return process')()) to access Node.js globals and execute arbitrary code. This is an incomplete fix for CVE-2024-21534.
Affected ProductsAI
jsonpath-plus < 10.3.0 Applications using jsonpath-plus with user-controlled queries
RemediationAI
Update jsonpath-plus to version 10.3.0 or later. Never pass untrusted input as JSONPath expressions. If JSONPath queries must be user-controlled, implement server-side validation that rejects expressions containing constructor, __proto__, or prototype references.
Vendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today