ROOT-APP-NPM-CVE-2025-1302 CVE-2025-1302 in jsonpath-plus - Patched by Root

🗓️ 06 Aug 2026 14:27:35Reported by GoogleType

osv🔗 osv.dev👁 13 Views

Root patches CVE-2025-1302 in @rootio/jsonpath-plus package for Root npm with fixed versions.

Reporter	Title	Published	Views	Family All 48
GithubExploit	Exploit for Code Injection in Symfony Twig	3 Jan 202620:15	–	githubexploit
GithubExploit	Exploit for CVE-2025-1302	25 Feb 202508:36	–	githubexploit
GithubExploit	Exploit for CVE-2025-1302	27 Feb 202604:05	–	githubexploit
GithubExploit	Exploit for CVE-2025-1302	24 Jul 202517:45	–	githubexploit
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in jsonpath-plus affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	21 May 202514:58	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security vulnerabilities affecting IBM Knowledge Catalog Premium Cartridge	11 Mar 202619:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to remote code execution [CVE-2025-1302]	8 May 202517:56	–	ibm
IBM Security Bulletins	Security Bulletin:IBM Event Streams is vulnerable to Remote Code Execution (RCE) attack due to the jsonpath-plus ( CVE-2025-1302).	19 May 202502:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to Remote Code Execution and improper preservation of permissions due to jsonpath-plus & snowflake-sdk (CVE-2025-1302 & CVE-2025-24791)	26 Jun 202516:07	–	ibm

06 Aug 2026 15:45Current

7.6High risk

Vulners AI Score7.6

CVSS 49.3

CVSS 3.19.8

EPSS0.10395

SSVC