{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/jsonpath-plus-v3.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2025-1302"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["jsonpath-plus (v3.1)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","injection","web-application","library-vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2025-1302 is a critical remote code execution (RCE) vulnerability affecting the jsonpath-plus library. The flaw exists due to the unsafe usage of the 'eval' function within JSONPath filter expressions. An attacker can supply a crafted JSONPath payload through a query parameter (typically mapped to the 'path' field in affected applications), which is then evaluated by the library. This allows for the execution of arbitrary JavaScript commands within the context of the host application. Public proof-of-concept exploits exist, demonstrating the ability to establish reverse shells using 'child_process' primitives in Node.js environments. Organizations using applications that incorporate jsonpath-plus as a dependency for processing user-supplied JSON paths are at high risk of unauthenticated RCE.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a web application or API endpoint that accepts user-provided JSONPath expressions as input.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious JSONPath filter expression containing JavaScript code, specifically utilizing the constructor method to reach 'child_process' execution.\u003c/li\u003e\n\u003cli\u003eAttacker sends the payload to the vulnerable endpoint via an HTTP GET or POST request containing the parameter (often named 'path' or 'query').\u003c/li\u003e\n\u003cli\u003eThe application processes the input using a vulnerable version of the jsonpath-plus library.\u003c/li\u003e\n\u003cli\u003eThe library's filter expression parser triggers an unsafe 'eval' execution of the attacker-supplied JavaScript string.\u003c/li\u003e\n\u003cli\u003eThe payload executes commands on the server, such as initiating a reverse shell via '/dev/tcp/' or '/bin/bash'.\u003c/li\u003e\n\u003cli\u003eAttacker establishes a persistent interactive connection back to an attacker-controlled listener for further post-exploitation activities.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote code execution on the server hosting the affected application. This enables attackers to steal sensitive data, modify application files, pivot into the internal network, or deploy secondary payloads. The vulnerability is rated CVSS 9.8 and requires no privileges or user interaction, making it highly attractive for automated exploitation attempts across internet-facing services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize patching or updating the jsonpath-plus dependency in all custom applications and third-party software to the latest secure version. Until a patch is applied, implement strict input validation to sanitize and reject any JSONPath expressions that contain characters associated with JavaScript execution (e.g., '(', ')', 'eval', 'constructor'). Ensure web application firewalls (WAFs) are configured to detect and block requests containing common JSONPath injection patterns found in the public PoC code, such as those attempting to invoke 'child_process' or 'require'. Monitor web server logs for suspicious requests to API endpoints that contain complex, non-standard JSONPath queries.\u003c/p\u003e\n","date_modified":"2026-09-18T18:34:11Z","date_published":"2026-09-18T18:34:11Z","id":"https://feed.craftedsignal.io/briefs/2026-09-jsonpath-plus-rce/","summary":"CVE-2025-1302 is a critical remote code execution vulnerability in the jsonpath-plus library, exploitable via malicious JSONPath expressions injected through query parameters.","title":"Remote Code Execution in jsonpath-plus via CVE-2025-1302","url":"https://feed.craftedsignal.io/briefs/2026-09-jsonpath-plus-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Jsonpath-Plus (V3.1)","version":"https://jsonfeed.org/version/1.1"}