CVE-2025-1302

Summary

CVE-2025-1302: Versions of the jsonpath-plus package prior to 10.3.0 contain a Remote Code Execution (RCE) vulnerability due to insufficient input sanitization. An attacker can exploit the unsafe default usage of 'eval=safe' mode to execute arbitrary code on the affected system. This issue stems from an incomplete fix for CVE-2024-21534. Organizations using jsonpath-plus are advised to upgrade immediately to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.