Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-1302
CVE-2025-1302:
JavaScript vulnerability analysis and mitigation
Overview
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. The vulnerability was discovered on January 10, 2025, and publicly disclosed on February 14, 2025. This issue exists as a result of an incomplete fix for a previous vulnerability (CVE-2024-21534) (NVD, Snyk).
Technical details
The vulnerability allows attackers to execute arbitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. The issue stems from improper handling of non-string property names in the AST evaluator, where the blacklist protection can be bypassed by passing a prop value that is not a string but will be converted to a string containing a forbidden value when toString() is implicitly called during evaluation (GitHub Gist).
Impact
The vulnerability can lead to Remote Code Execution (RCE) in server-side contexts where calls to JSONPath() are made with paths constructed from user input. In client-side contexts, this can result in Cross-Site Scripting (XSS) attacks. The vulnerability has been assigned a critical severity rating with significant impact on confidentiality, integrity, and availability (Snyk).
Mitigation and workarounds
Users should upgrade jsonpath-plus to version 10.3.0 or higher, which contains the fix for this vulnerability. The fix involves proper handling of non-string property names in the AST evaluator (Snyk).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management