CVE-2025-1302_jsonpath-plus_RCE

CVE-2025-1302 JSONPath-Plus RCE PoC PoC Script Name: poc.py A proof-of-concept exploit script for CVE-2025-1302, which targets an RCE vulnerability in the jsonpath-plus library. When run against a vulnerable service endpoint, the script attempts to trigger remote code execution via a JSONPath...

CVE-2025-1302

CVE-2025-1302 ★ CVE-2025-1302 JSONPath-plus RCE PoC ★ https://github.com/user-attachments/assets/5d791540-ef6c-4cd0-bd25-7a1dbbd194fb ラボのセットアップ root@kitploit: docker build -t jsonpath:10.2.0 . docker run --rm --name jsonpath -p 3000:3000 jsonpath:10.2.0 localhost:3000 説明 jsonpath-plus パッケージの 10.3...

JSONPath

개발 종속성 라이선스는 여기를 참조하세요 JSONPath Plus JSON 문서및 JavaScript 객체에서 데이터를 분석, 변환, 선택적으로 추출합니다. jsonpath-plus는 원래 사양을 확장하여 일부 추가 연산자를 제공하고, 원래 사양에서 명시하지 않은 일부 동작을 명확히 합니다. 브라우저 데모 또는 Runkit Node를 사용해 보세요. 참고: 이 프로젝트는 현재 적극적으로 유지관리되고 있지 않습니다. 잘 문서화된 PR이나 간단한 업데이트는 수락할 수 있지만, 저희가 직접 수정하거나 새로운 기능을 추가할 계획은...

cve-2024-21534

POC - CVE-2024-21534 Jsonpath-plus, 부적절한 입력 검증으로 인한 원격 코드 실행RCE 취약점 개요 CVE-2024-21534는 jsonpath-plus 패키지의 10.0.0 이전 버전에서 발견된 심각한 취약점입니다. 이 취약점은 부적절한 입력 검증에서 비롯되며, 영향을 받는 시스템에서 원격 코드 실행RCE으로 이어질 수 있습니다. 이 취약점은 인증 없이도 악용될 수 있어 특히 위험하며, 공격자는 특수하게 조작된 입력을 전송하여 서버에서 임의의 코드를 실행할 수 있습니다. 이 문제는 안전하지 않은 기...

JSONPath Plus < 10.3.0 - Remote Code Execution

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for...

CVE-2024-21534

CVE-2024-21534: jsonpath-plus =10.0.7에서의 원격 코드 실행 취약점 요약 이 저장소는 jsonpath-plus 패키지의 버전 10.0.7 이전에 영향을 미치는 치명적인 원격 코드 실행RCE 취약점에 대한 개념 증명PoC 익스플로잇을 포함하고 있습니다. 이 문제는 부적절한 입력 검증으로 인해 발생하며, 공격자가 Node의 VM 모듈에서 안전하지 않은 기본값을 활용하여 임의 코드를 실행할 수 있도록 합니다. 이 취약점은 2024-10-11에 공개되었으며 CVSS 점수 는 9.8치명적입니다. 참고: 버전...

CVE-2024-21534-poc

Vulnerability: CVE-2024-21534 Severity: Critical CVSS Score: 9.8 Description: The jsonpath-plus package versions = 10.0.7 is vulnerable to a Remote Code Execution RCE vulnerability that allows attackers to execute arbitrary code via Node.js's VM module. This vulnerability is caused by insufficien...

ROOT-APP-NPM-CVE-2025-1302 CVE-2025-1302 in jsonpath-plus - Patched by Root

Root has patched CVE-2025-1302 in the jsonpath-plus package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-21534 CVE-2024-21534 in jsonpath-plus - Patched by Root

Root has patched CVE-2024-21534 in the jsonpath-plus package for Root:npm. Multiple fixed versions available...

CLSA-2026-1780966310 TuxCare security update for jsonpath-plus (2 CVEs)

TuxCare rebuilt jsonpath-plus to address 2 CVEs. Fixed in 5.1.0-tuxcare.1...

CLSA-2026-1780966312 TuxCare security update for jsonpath-plus (2 CVEs)

TuxCare rebuilt jsonpath-plus to address 2 CVEs. Fixed in 6.0.1-tuxcare.1...

CLSA-2026-1774657375 TuxCare security update for jsonpath-plus (1 CVE)

TuxCare rebuilt jsonpath-plus to address 1 CVE. Fixed in 7.2.0-tuxcare.2...

CLSA-2026-1774657371 TuxCare security update for jsonpath-plus (2 CVEs)

TuxCare rebuilt jsonpath-plus to address 2 CVEs. Fixed in 7.2.0-tuxcare.1...

Exploit for CVE-2025-1302

Research: jsonpath-plus RCE CVE-2025-1302 Analysis !Securi...

📄 JSONPath Plus Remote Code Execution

This Metasploit module exploits a remote code execution vulnerability in JSONPath Plus library versions prior to 10.3.0 The vulnerability allows arbitrary JavaScript code execution through malicious JSONPath expressions...

VulnCheck KEV: CVE-2025-1302

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in jsonpath-plus-10.2.0.tgz

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of jsonpath-plus-10.2.0.tgz Vulnerability Details CVEID:CVE-2025-1302 DESCRIPTION: Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacke...

Exploit for CVE-2025-1302

CVE-2025-1302 JSONPath-Plus RCE PoC PoC Script Name: po...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in jsonpath-plus-0.19.0.tgz

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of jsonpath-plus-0.19.0.tgz Vulnerability Details CVEID:CVE-2024-21534 DESCRIPTION: All versions of the package jsonpath-plus are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Remote Code Execution and improper preservation of permissions due to jsonpath-plus & snowflake-sdk (CVE-2025-1302 & CVE-2025-24791)

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to Remote Code Execution RCE and improper preservation of permissions due to jsonpath-plus & snowflake-sdk. Vulnerabilit...