CVE-2024-21534

CVSS V2 None CVSS V3 None

Description

Versions of the package jsonpath-plus before 10.0.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. **Note:** The unsafe behavior is still available after applying the fix but it is not turned on by default.

Overview

CVE ID
CVE-2024-21534

Assigner
snyk

Vulnerability Status
PUBLISHED

Published Version
2024-10-11T05:00:01.824Z

Last Modified Date
2024-10-11T05:00:01.824Z

Weakness Enumerations

CWE	URL
CWE-94	http://cwe.mitre.org/data/definitions/94.html

References

Reference URL	Reference Tags
https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884
https://github.com/JSONPath-Plus/JSONPath/commit/6b2f1b4c234292c75912b790bf7e2d7339d4ccd3

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-21534
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21534

History

Created	Old Value	New Value	Data Type	Notes
2024-10-11 13:46:27				Added to TrackCVE