CVE-2025-1302
Published: 15 February 2025
Summary
CVE-2025-1302 is a high-severity Code Injection (CWE-94) vulnerability in Snyk (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Versions of the jsonpath-plus package before 10.3.0 are vulnerable to remote code execution through improper input sanitization. The issue stems from unsafe default handling in eval='safe' mode, which permits arbitrary code execution on the host system, and represents an incomplete remediation of the earlier CVE-2024-21534 flaw. The vulnerability is tracked under CWE-94 and carries a CVSS 4.0 score of 8.9.
An unauthenticated attacker with network access can supply a malicious JSONPath expression that triggers code execution without requiring user interaction or elevated privileges. Successful exploitation grants the attacker full control over the confidentiality, integrity, and availability of the affected system.
The referenced GitHub commit and Snyk advisory indicate that updating to jsonpath-plus 10.3.0 or later resolves the issue by strengthening input handling and removing the unsafe default behavior. The current EPSS score of 0.8993, which matches its recorded peak, reflects sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2104
Vulnerability details
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is…
more
caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct RCE via unsafe eval in public-facing JS package enables T1190 exploitation and arbitrary JS command execution via T1059.007.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identifying, prioritizing, and patching flaws like the RCE in vulnerable jsonpath-plus versions prior to 10.3.0.
Mandates validation of information inputs to counter the improper input sanitization enabling code injection via unsafe eval in jsonpath-plus.
Provides vulnerability scanning to identify the presence of the exploitable jsonpath-plus package version in system components or dependencies.