Jsonpath-Plus (V3.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/jsonpath-plus-v3.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 18 Sep 2026 18:34:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Code Execution in jsonpath-plus via CVE-2025-1302https://feed.craftedsignal.io/briefs/2026-09-jsonpath-plus-rce/Fri, 18 Sep 2026 18:34:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-jsonpath-plus-rce/CVE-2025-1302 is a critical remote code execution vulnerability in the jsonpath-plus library, exploitable via malicious JSONPath expressions injected through query parameters.CVE-2025-1302 is a critical remote code execution (RCE) vulnerability affecting the jsonpath-plus library. The flaw exists due to the unsafe usage of the 'eval' function within JSONPath filter expressions. An attacker can supply a crafted JSONPath payload through a query parameter (typically mapped to the 'path' field in affected applications), which is then evaluated by the library. This allows for the execution of arbitrary JavaScript commands within the context of the host application. Public proof-of-concept exploits exist, demonstrating the ability to establish reverse shells using 'child_process' primitives in Node.js environments. Organizations using applications that incorporate jsonpath-plus as a dependency for processing user-supplied JSON paths are at high risk of unauthenticated RCE.

Attack Chain

  1. Attacker identifies a web application or API endpoint that accepts user-provided JSONPath expressions as input.
  2. Attacker crafts a malicious JSONPath filter expression containing JavaScript code, specifically utilizing the constructor method to reach 'child_process' execution.
  3. Attacker sends the payload to the vulnerable endpoint via an HTTP GET or POST request containing the parameter (often named 'path' or 'query').
  4. The application processes the input using a vulnerable version of the jsonpath-plus library.
  5. The library's filter expression parser triggers an unsafe 'eval' execution of the attacker-supplied JavaScript string.
  6. The payload executes commands on the server, such as initiating a reverse shell via '/dev/tcp/' or '/bin/bash'.
  7. Attacker establishes a persistent interactive connection back to an attacker-controlled listener for further post-exploitation activities.

Impact

Successful exploitation results in full remote code execution on the server hosting the affected application. This enables attackers to steal sensitive data, modify application files, pivot into the internal network, or deploy secondary payloads. The vulnerability is rated CVSS 9.8 and requires no privileges or user interaction, making it highly attractive for automated exploitation attempts across internet-facing services.

Recommendation

Prioritize patching or updating the jsonpath-plus dependency in all custom applications and third-party software to the latest secure version. Until a patch is applied, implement strict input validation to sanitize and reject any JSONPath expressions that contain characters associated with JavaScript execution (e.g., '(', ')', 'eval', 'constructor'). Ensure web application firewalls (WAFs) are configured to detect and block requests containing common JSONPath injection patterns found in the public PoC code, such as those attempting to invoke 'child_process' or 'require'. Monitor web server logs for suspicious requests to API endpoints that contain complex, non-standard JSONPath queries.

]]>criticaladvisoryremote-code-executioninjectionweb-applicationlibrary-vulnerability