CVE-2025-1302 in the critical feed json
JSONPath Plus allows Remote Code Execution
published 2025-02-15 20 mo ago modified 2026-09-10 1 mo ago also GHSA-hw8r-x6gr-5gjp , EUVD-2025-2104
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 10.4%
- EPSS 10.4% chance of exploitation in 30 days, percentile 95%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).
Patch / fix
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-1302 updated cvss 9.8
jsonpath-plus: Remote Code Execution in jsonpath-plus via Improper Input Sanitization
-
Red Hat OpenShift Serverless openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8not affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction
10.39% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template JSONPath Plus < 10.3.0 - Remote Code Execution nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P |
| CNA | 4.0 | 8.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | jsonpath-plus | <10.3.0 |
10.3.0 |
Affected products
- n/a jsonpath-plus
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/JSONPath-Plus/JSONPath/commit/30942896d27cb8a806b965a5ca9ef9f686be24ee
web
-
security.snyk.io
/vuln/SNYK-JS-JSONPATHPLUS-8719585
web
-
gist.github.com
/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456
web
- github.com /JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js%23L127
-
nvd.nist.gov
/vuln/detail/CVE-2024-21534
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-1302
advisory
-
github.com
/JSONPath-Plus/JSONPath
package
-
github.com
/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js#L127
web
Sources
- CVE List CVE-2025-1302
- GitHub Advisory GHSA-hw8r-x6gr-5gjp
- NVD CVE-2025-1302
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.