Homepage
About Snyk

jsonpath-plus@0.20.0 vulnerabilities

A JS implementation of JSONPath with some additional operators

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the jsonpath-plus package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • C
Remote Code Execution (RCE)

jsonpath-plus is an A JS implementation of JSONPath with some additional operators

Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.

Note:

There were several attempts to fix it in versions 10.0.0-10.1.0 but it could still be exploited using different payloads.

How to fix Remote Code Execution (RCE)?

There is no fixed version for jsonpath-plus.

*
Go back to all versions of this package