cve-2024-21534

POC - CVE-2024-21534 Jsonpath-plus anfällig für Remote Code Execution RCE aufgrund unzureichender Eingabebereinigung Übersicht CVE-2024-21534 ist eine kritische Sicherheitslücke, die in Versionen des jsonpath-plus-Pakets vor Version 10.0.0 gefunden wurde. Die Sicherheitslücke resultiert aus...

CVE-2025-1302

CVE-2025-1302 ★ CVE-2025-1302 JSONPath-plus RCE PoC ★ https://github.com/user-attachments/assets/5d791540-ef6c-4cd0-bd25-7a1dbbd194fb Configurazione del laboratorio root@kitploit: docker build -t jsonpath:10.2.0 . docker run --rm --name jsonpath -p 3000:3000 jsonpath:10.2.0 localhost:3000...

JSONPath Plus < 10.3.0 - Remote Code Execution

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for...

CVE-2024-21534

CVE-2024-21534: Vulnerabilità di Esecuzione Remota di Codice in jsonpath-plus =10.0.7 Riepilogo Questo repository contiene un exploit Proof of Concept PoC per una vulnerabilità critica di Esecuzione Remota di Codice RCE nel pacchetto jsonpath-plus, che interessa le versioni precedenti alla 10.0.7...

JSONPath

（開発依存関係のライセンスも参照してください：licenses for dev. deps.） JSONPath Plus JSONドキュメント（およびJavaScriptオブジェクト）からデータを分析、変換、選択的に抽出します。 jsonpath-plus は元の仕様を拡張し、いくつかの追加演算子を加え、元の仕様が明確にしていなかった動作を明示します。 ブラウザデモ または Runkit Node をお試しください。...

CVE-2024-21534-poc

Vulnerability: CVE-2024-21534 Severity: Kritisch CVSS Score: 9.8 Description: Das Paket jsonpath-plus Versionen = 10.0.7 ist anfällig für eine Remote-Code-Ausführung RCE Schwachstelle, die es Angreifern ermöglicht, beliebigen Code über das VM-Modul von Node.js auszuführen. Diese Schwachstelle wir...

CVE-2025-1302_jsonpath-plus_RCE

CVE-2025-1302 JSONPath-Plus RCE PoC Nome dello script PoC: poc.py Uno script exploit proof-of-concept per CVE-2025-1302, che mira a una vulnerabilità RCE nella libreria jsonpath-plus. Quando viene eseguito contro un endpoint di servizio vulnerabile, lo script tenta di innescare l'esecuzione remot...

ROOT-APP-NPM-CVE-2025-1302 CVE-2025-1302 in jsonpath-plus - Patched by Root

Root has patched CVE-2025-1302 in the jsonpath-plus package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-21534 CVE-2024-21534 in jsonpath-plus - Patched by Root

Root has patched CVE-2024-21534 in the jsonpath-plus package for Root:npm. Multiple fixed versions available...

CLSA-2026-1780966310 TuxCare security update for jsonpath-plus (8 CVEs)

TuxCare rebuilt jsonpath-plus to address 8 CVEs. Fixed in 5.1.0-tuxcare.1...

CLSA-2026-1774657371 TuxCare security update for jsonpath-plus (24 CVEs)

TuxCare rebuilt jsonpath-plus to address 24 CVEs. Fixed in 7.2.0-tuxcare.1...

Exploit for CVE-2025-1302

Research: jsonpath-plus RCE CVE-2025-1302 Analysis !Securi...

📄 JSONPath Plus Remote Code Execution

This Metasploit module exploits a remote code execution vulnerability in JSONPath Plus library versions prior to 10.3.0 The vulnerability allows arbitrary JavaScript code execution through malicious JSONPath expressions...

VulnCheck KEV: CVE-2025-1302

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in jsonpath-plus-10.2.0.tgz

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of jsonpath-plus-10.2.0.tgz Vulnerability Details CVEID:CVE-2025-1302 DESCRIPTION: Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacke...

Exploit for CVE-2025-1302

CVE-2025-1302 JSONPath-Plus RCE PoC PoC Script Name: po...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in jsonpath-plus-0.19.0.tgz

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of jsonpath-plus-0.19.0.tgz Vulnerability Details CVEID:CVE-2024-21534 DESCRIPTION: All versions of the package jsonpath-plus are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Remote Code Execution and improper preservation of permissions due to jsonpath-plus & snowflake-sdk (CVE-2025-1302 & CVE-2025-24791)

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to Remote Code Execution RCE and improper preservation of permissions due to jsonpath-plus & snowflake-sdk. Vulnerabilit...

Security Bulletin: Vulnerability in jsonpath-plus affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in jsonpath-plus has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

Security Bulletin:IBM Event Streams is vulnerable to Remote Code Execution (RCE) attack due to the jsonpath-plus ( CVE-2025-1302).

Summary IBM Event Streams is vulnerable to Remote Code Execution RCE due to the jsonpath-plus package, which is typically used for querying and extracting specific data from complex JSON documents, helping in parsing message payloads, filtering data within topics, and extracting specific fields f...