CVE-2024-21534
JSONPath Plus Remote Code Execution (RCE) Vulnerability
Reported by snyk · Published October 11, 2024
jsonpath-plus is fixed in 6.0.1 (Maven Central)
All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. **Note:** There were several attempts to fix it in versions [10.0.0-10.1.0](https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0) but it could still be exploited using [different payloads](https://github.com/JSONPath-Plus/JSONPath/issues/226).
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| org.webjars.npm:jsonpath-plus | Maven Central | 6.0.1 |
| jsonpath-plus | npm | 10.2.0 |
| prism | Chainguard | 5.11.2-r1 |
| jsonpath | jsonpath-plus | 10.0.7 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | jsonpath-plus | 0 |
| n/a | org.webjars.npm:jsonpath-plus | 0 |
| chainguard | prism | 0 |
| jsonpath-plus | jsonpath | 0 |
| npm | jsonpath-plus | 0 |
| chainguard | kubeflow-pipelines | 0 |
| chainguard | kubeflow-centraldashboard | 0 |
| wolfi | kubeflow-katib | 0, 0 |
| chainguard | kubeflow-katib | 0, 0 |
| wolfi | prism | 0 |
| Maven | org.webjars.npm:jsonpath-plus | 0 |
| wolfi | kubeflow-centraldashboard | 0 |
| n/a | org.webjars.npm:jsonpath-plus | 0 |
| n/a | jsonpath-plus | 0 |
| wolfi | kubeflow-pipelines | 0 |
Timeline
- Oct 11, 2024 CVE Published
- Oct 12, 2024 EPSS Score (30 in total, the first dated here)
- Oct 14, 2024 Coalition ESS Score (14 in total, the first dated here)
- May 8, 2025 CVE Updated
- Mar 9, 2026 Security Advisory (8 in total, the first dated here)
- Nov 1, 2026 Distribution Patch (7 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-21534
vulnetix vdb fixes CVE-2024-21534Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-21534/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- CVE-2024-21534 exploit
- cve-2024-21534-poc exploit
- cve-2024-21534 exploit
- https://nvd.nist.gov/vuln/detail/CVE-2024-21534 advisory
- https://github.com/advisories/GHSA-pppg-cpfq-h7wr advisory
- https://github.com/JSONPath-Plus/JSONPath/issues/226#issuecomment-2424230316 url
- https://github.com/JSONPath-Plus/JSONPath/pull/233 patch
- https://github.com/JSONPath-Plus/JSONPath/commit/6b2f1b4c234292c75912b790bf7e2d7339d4ccd3 patch
- https://github.com/JSONPath-Plus/JSONPath/commit/73ad72e5ee788d8287dea6e8283a3f16f63c9eb8 patch
- https://github.com/JSONPath-Plus/JSONPath/commit/b70aa713553caf838a63bac923195a5bc541fd72 patch
- https://github.com/JSONPath-Plus/JSONPath url