CVE-2024-21534
- State
- Published
- Severity
- 9.8 Critical
- Published
- Oct 11, 2024
- Updated
- Nov 18, 2024
- Reserved
- Dec 22, 2023
Description
All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. **Note:** There were several attempts to fix it in versions [10.0.0-10.1.0](https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0) but it could still be exploited using [different payloads](https://github.com/JSONPath-Plus/JSONPath/issues/226).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P | snyk |
Weaknesses
- CWE-94 Remote Code Execution (RCE)
Affected Products
| Product | Versions |
|---|---|
jsonpath-plusn/a |
|
org.webjars.npm:jsonpath-plusn/a |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.