Homepage
About Snyk

org.webjars.npm:jsonpath-plus@6.0.1 vulnerabilities

  • latest version

    6.0.1

  • first published

    4 years ago

  • latest version published

    2 years ago

  • licenses detected

  • package manager

    View on Maven Repository
Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:jsonpath-plus package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • C
Remote Code Execution (RCE)

org.webjars.npm:jsonpath-plus is an A JS implementation of JSONPath with some additional operators

Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.

Note:

This vulnerability was mitigated in version 10.0.0 but it can still be exploited using different payloads.

How to fix Remote Code Execution (RCE)?

There is no fixed version for org.webjars.npm:jsonpath-plus.

[0,)
Go back to all versions of this package