Bug 2345890 (CVE-2025-1302)

Summary:	CVE-2025-1302 jsonpath-plus: Remote Code Execution in jsonpath-plus via Improper Input Sanitization
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	alcohan, dhanak, dsimansk, gkamathe, gparvin, jforrest, jkoehler, kingland, kverlaen, lphiri, matzew, mnovotny, njean, owatkins, pahickey, pierdipi, rguimara, rhaigner, rhuss, sdawley
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in jsonpath-plus. This vulnerability allows remote code execution (RCE) via improper input sanitization, exploiting the unsafe default usage of eval='safe' mode.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-02-15 06:01:03 UTC

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.

**Note:**

This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).