JSONPath

see also licenses for dev. deps. JSONPath Plus Analyse, transform, and selectively extract data from JSON documents and JavaScript objects. jsonpath-plus expands on the original specification to add some additional operators and makes explicit some behaviors the original did not spell out. Try th...

CVE-2026-77635

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-77635 CVE-2026-77635 CakePHP 5.2.13 - cakephp I am @abraxasnull. Loopback lab. The client is CVE-2026-77635-Abraxas-Labs.py. JSONVALUE is not bound. FunctionsBuilder::jsonValue with PostgresDriver rewrites to...

CVE-2025-1302_jsonpath-plus_RCE

CVE-2025-1302 JSONPath-Plus RCE PoC PoC Script Name: poc.py A proof-of-concept exploit script for CVE-2025-1302, which targets an RCE vulnerability in the jsonpath-plus library. When run against a vulnerable service endpoint, the script attempts to trigger remote code execution via a JSONPath...

CVE-2025-1302

CVE-2025-1302 ★ CVE-2025-1302 JSONPath-plus RCE PoC ★ https://github.com/user-attachments/assets/5d791540-ef6c-4cd0-bd25-7a1dbbd194fb Lab Setup docker build -t jsonpath:10.2.0 . docker run --rm --name jsonpath -p 3000:3000 jsonpath:10.2.0 localhost:3000 Description Versions of the package...

CVE-2024-21534-poc

漏洞: CVE-2024-21534 严重性: 严重 CVSS 评分: 9.8 描述: jsonpath-plus 包（版本 = 10.0.7）存在一个远程代码执行 RCE 漏洞，攻击者能够通过 Node.js 的 VM 模块执行任意代码。此漏洞由输入验证不足导致，影响 10.0.7 及以下版本。 影响: 成功利用此漏洞可能导致受影响的系统完全沦陷。 缓解措施: 1. 升级jsonpath-plus： 更新至 10.0.8 或更高版本。 2. 输入验证： 对 JSONPath 表达式实施严格的输入验证，防止恶意输入。 3. VM 模块使用： 尽量减少 VM 模块的使用，并严格控制其执行环...

cve-2024-21534

POC - CVE-2024-21534 Jsonpath-plus は不適切な入力サニタイズによりリモートコード実行（RCE）に対して脆弱です 概要 CVE-2024-21534 は、jsonpath-plus パッケージの 10.0.0 より前のバージョンに見つかった重大な脆弱性です。この脆弱性は不適切な入力サニタイズに起因し、影響を受けるシステム上でリモートコード実行（RCE）を引き起こす可能性があります。この脆弱性は認証なしで悪用される可能性があるため、特に危険です。攻撃者は特別に細工された入力を送信することで、サーバー上で任意のコードを実行できます。この問題は Node.js ...

JSONPath Plus < 10.3.0 - Remote Code Execution

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for...

CVE-2026-29053

CVE-2026-29053 Ghost CMS RCE via jsonpath/static-eval prototype chain. Info CVE : CVE-2026-29053 Affected : Ghost -p 1. Start listener: nc -lvnp 2. Upload malicious-theme.zip to Ghost Admin → Settings → Design 3. Create page with slug rce 4. Visit /rce/ References...

CVE-2024-21534

CVE-2024-21534: Remote Code Execution Vulnerability in jsonpath-plus =10.0.7 Summary This repository contains a Proof of Concept PoC exploit for a critical Remote Code Execution RCE vulnerability in the jsonpath-plus package, affecting versions prior to 10.0.7. The issue stems from improper input...

ROOT-APP-NPM-CVE-2024-21534 CVE-2024-21534 in jsonpath-plus - Patched by Root

Root has patched CVE-2024-21534 in the jsonpath-plus package for Root:npm. Multiple fixed versions available...

Exploit for CVE-2026-77635

abraxaslabs.tech · github.com/abraxas ·&...

ROOT-APP-NPM-CVE-2025-61140 CVE-2025-61140 in jsonpath - Patched by Root

Root has patched CVE-2025-61140 in the jsonpath package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-1615 CVE-2026-1615 in jsonpath - Patched by Root

Root has patched CVE-2026-1615 in the jsonpath package for Root:npm. Multiple fixed versions available...

CVE-2026-8462

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to...

CVE-2026-8462 OpenMeter SQL Injection in ClickHouse-backed Meter Definitions

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to...

CVE-2026-8462

CVE-2026-8462 is a SQL injection in OpenMeter (versions before v1.0.0-beta.228 ) in the ClickHouse-backed meter definitions. The vulnerable code in openmeter/streaming/clickhouse/utils_query.go builds ClickHouse queries using fmt.Sprintf with sqlbuilder.Escape(), which fails to escape single quot...

CVE-2026-8462 OpenMeter SQL Injection in ClickHouse-backed Meter Definitions

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to...

CVE-2026-8462 OpenMeter SQL Injection in ClickHouse-backed Meter Definitions

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to...

EUVD-2026-80392

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to...

CVE-2026-8462: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to...