Cyber Resilience

CVE-2025-1302

HighRCE

Published: 15 February 2025

Published
15 February 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 8.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.9081 99.6th percentile
Risk Priority 72 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1302 is a high-severity Code Injection (CWE-94) vulnerability in Snyk (inferred from references). Its CVSS base score is 8.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

Versions of the jsonpath-plus package before 10.3.0 are vulnerable to remote code execution through improper input sanitization. The issue stems from unsafe default handling in eval='safe' mode, which permits arbitrary code execution on the host system, and represents an incomplete remediation of the earlier CVE-2024-21534 flaw. The vulnerability is tracked under CWE-94 and carries a CVSS 4.0 score of 8.9.

An unauthenticated attacker with network access can supply a malicious JSONPath expression that triggers code execution without requiring user interaction or elevated privileges. Successful exploitation grants the attacker full control over the confidentiality, integrity, and availability of the affected system.

The referenced GitHub commit and Snyk advisory indicate that updating to jsonpath-plus 10.3.0 or later resolves the issue by strengthening input handling and removing the unsafe default behavior. The current EPSS score of 0.8993, which matches its recorded peak, reflects sustained exploitation interest following disclosure.

EU & UK References

Vulnerability details

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is…

more

caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

Direct RCE via unsafe eval in public-facing JS package enables T1190 exploitation and arbitrary JS command execution via T1059.007.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-25887Shared CWE-94
CVE-2026-41507Shared CWE-94
CVE-2025-23061Shared CWE-94
CVE-2026-43997Shared CWE-94
CVE-2026-1615Shared CWE-94
CVE-2026-33943Shared CWE-94
CVE-2026-33881Shared CWE-94
CVE-2026-4800Shared CWE-94
CVE-2026-25141Shared CWE-94
CVE-2025-26260Shared CWE-94

Affected Assets

Snyk
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires identifying, prioritizing, and patching flaws like the RCE in vulnerable jsonpath-plus versions prior to 10.3.0.

prevent

Mandates validation of information inputs to counter the improper input sanitization enabling code injection via unsafe eval in jsonpath-plus.

detect

Provides vulnerability scanning to identify the presence of the exploitable jsonpath-plus package version in system components or dependencies.

References