CVE-2024-21534

All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. **Note:** There were several attempts to fix it in versions [10.0.0-10.1.0](https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0) but it could still be exploited using [different payloads](https://github.com/JSONPath-Plus/JSONPath/issues/226).

Affected

jsonpath-plus · org.webjars.npm:jsonpath-plus

CVSS v4.0 GitHub

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS v3.1 SNYK

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

9.02% chance of exploitation in the next 30 days, 95th percentile

Published

2024-10-11

Updated

2024-11-18

Proof-of-concept exploits (3)

• pabloopez/CVE-2024-215341★ · 2024-11-27
• verylazytech/cve-2024-215345★ · 2024-11-28
• BohemianHacks/CVE-2024-21534-poc1★ · 2024-11-23

Security advisories

• advisories/GHSA-pppg-cpfq-h7wr

References

• CVE Record
• NVD entry

Related

• CVE-2024-10914
• CVE-2024-23692
• CVE-2024-23897
• CVE-2024-24919
• CVE-2024-4358
• CVE-2024-45241