From e5ccb5d7f42d3171af9078e3e47949c8fe3b7b1d Mon Sep 17 00:00:00 2001 From: dr-esec Date: Tue, 24 Jun 2025 13:44:36 +0200 Subject: [PATCH] Changed jsonpath plus version to 10.3.0 Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. https://github.com/advisories/GHSA-pppg-cpfq-h7wr --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 9191ab6f..6097b6a0 100644 --- a/package.json +++ b/package.json @@ -143,7 +143,7 @@ "jsesc": "^3.0.2", "json5": "^2.2.3", "jsonata": "^2.0.3", - "jsonpath-plus": "^9.0.0", + "jsonpath-plus": "^10.3.0", "jsonwebtoken": "8.5.1", "jsqr": "^1.4.0", "jsrsasign": "^11.1.0",