CVE-2025-1302

What it actually does

jsonpath-plus versions before 10.3.0 improperly sanitize input when evaluating JSONPath expressions, including in the unsafe default eval='safe' mode. If an application accepts attacker-controlled JSONPath queries or filters and passes them to the library, crafted expressions can break out of the intended sandbox and execute arbitrary JavaScript in the Node.js process. Successful exploitation can allow command execution with the privileges of the application process, access to environment variables and secrets, modification or deletion of data reachable by the service, and potential lateral movement from the compromised runtime. This issue is an incomplete fix for the earlier jsonpath-plus code execution vulnerability CVE-2024-21534, so systems that only remediated the prior issue may still be exposed if they remain below the fixed release.

Why it matters to the business

A vulnerable service that processes untrusted JSONPath input can be taken over remotely without authentication or user interaction, creating risk of service outage, data theft, credential compromise, supply-chain exposure, and downstream compromise of systems that trust the affected application. The CVSS score is critical, exploit maturity is reported as weaponized, the issue has been public for an extended period, and EPSS indicates meaningful exploitation likelihood; even though it is not currently in CISA KEV and not specifically associated with ransomware campaigns, internet-facing or API-exposed uses should be treated as high urgency. Products or images embedding vulnerable jsonpath-plus versions, including affected Bitnami Hyperledger Fabric Orderer packaging, may inherit the risk even if jsonpath-plus is not used directly by application code.

How an attack unfolds

An attacker first identifies an application endpoint, API parameter, workflow rule, search feature, transformation pipeline, policy engine, or integration that accepts JSONPath expressions or otherwise feeds user-controlled data into jsonpath-plus. The attacker submits a specially crafted JSONPath filter intended to execute JavaScript despite the library's safe evaluation mode. If the application is using a vulnerable jsonpath-plus version and does not strictly validate or disable expression evaluation, the malicious expression runs inside the Node.js process. The attacker can then execute operating-system commands, read environment variables, access application credentials, alter application data, drop a web shell or persistence mechanism where feasible, or use the compromised process as a foothold for additional internal reconnaissance. Because public exploit techniques are weaponized and this bug is related to an incomplete prior fix, attackers may also scan for applications that previously patched CVE-2024-21534 but did not upgrade to a fully fixed jsonpath-plus release.

How to fix it

Upgrade jsonpath-plus to version 10.3.0 or later wherever it is present, including direct dependencies, transitive dependencies, vendored copies, container images, serverless bundles, and packaged applications. For source builds tracking the upstream Git repository, ensure the code includes fixed commit 30942896d27cb8a806b965a5ca9ef9f686be24ee or a later trusted commit. For Bitnami Hyperledger Fabric Orderer, upgrade to a fixed package version, including 2.2.7 or later as applicable. Regenerate lockfiles after dependency updates and redeploy all built artifacts that may have bundled the old package. As defense in depth, do not allow untrusted users to submit arbitrary JSONPath expressions; prefer allowlisted selectors, disable or avoid expression/filter evaluation where possible, validate JSONPath syntax server-side, run Node.js services with least privilege, restrict outbound network access, protect secrets from process environments where feasible, and apply runtime controls that limit child process execution from application services.

How to confirm the fix worked

Confirm dependency remediation by inspecting package manifests and lockfiles for jsonpath-plus versions and verifying all resolved versions are 10.3.0 or later. Use software composition analysis, npm/yarn/pnpm dependency tree commands, container image scanners, and artifact-level searches to find bundled copies under node_modules. Confirm Bitnami Hyperledger Fabric Orderer packages are version 2.2.7 or later where applicable. Validate deployed runtime artifacts, not only source repositories, because vulnerable dependencies may be embedded in containers, serverless packages, or prebuilt distributions. Exercise application security tests to ensure user-supplied JSONPath input is rejected, constrained to an allowlist, or evaluated only in a non-executable mode. After deployment, monitor for application errors or blocked payloads containing JavaScript execution primitives in JSONPath expressions, and verify no vulnerable package versions remain in production images or SBOMs.

Typical attack path

1. Discover an application feature or API that accepts JSONPath queries, filters, rules, selectors, or expressions.
2. Confirm that the backend uses jsonpath-plus or a bundled product containing a vulnerable jsonpath-plus version before 10.3.0.
3. Send a crafted JSONPath expression designed to escape the intended safe evaluation context.
4. Achieve arbitrary JavaScript execution in the Node.js application process.
5. Invoke sensitive runtime capabilities such as environment-variable access, filesystem access, network callbacks, or child process execution.
6. Exfiltrate secrets or data, modify application state, deploy persistence, or pivot to adjacent services using credentials available to the compromised process.

How to detect it

To determine whether exploitation already occurred, review application, API gateway, WAF, reverse proxy, and load balancer logs for requests containing JSONPath filters mixed with JavaScript execution primitives. Focus on parameters or request bodies carrying JSONPath selectors, filter expressions, rule definitions, query builders, workflow conditions, or transformation logic. Search Node.js application logs, stderr/stdout, process supervision logs, EDR telemetry, container runtime audit logs, and Kubernetes audit events for unexpected child processes spawned by Node.js, including shell, curl/wget, scripting interpreters, or reconnaissance commands. Inspect network telemetry for unexpected outbound callbacks from application containers or hosts shortly after suspicious JSONPath requests. Review filesystem and container-layer changes for dropped scripts, modified application files, new temporary files, or unauthorized package changes. Examine environment-variable access patterns and secret-management audit logs for unusual reads following suspicious requests. Because exploit strings may be URL-encoded, JSON-escaped, or split across fields, decode request bodies and normalize logs before searching. Correlate suspicious payloads with crashes, syntax errors, unusual 500 responses, new outbound connections, and node processes launching operating-system commands.

• node_modules/jsonpath-plus/package.json
• "jsonpath-plus"
• "jsonpath-plus":"<10.3.0"
• "jsonpath-plus": "<10.3.0"
• "version": "10.2.
• "version":"10.2.
• "version": "10.1.
• "version":"10.1.
• "version": "10.0.
• "version":"10.0.
• eval='safe'
• eval: 'safe'
• eval: "safe"
• constructor.constructor
• constructor['constructor']
• constructor["constructor"]
• Function(
• global.process
• process.mainModule
• process.env
• require('child_process')
• require("child_process")
• child_process.exec
• child_process.execSync
• child_process.spawn
• child_process.spawnSync
• module.require
• process.binding
• /bin/sh
• /bin/bash
• cmd.exe
• powershell.exe
• curl http
• wget http
• JSONPathError
• jsonpath-plus
• @.constructor
• $[?(
• ?(@

What your security team should do

• Prioritize remediation for internet-facing services, APIs, automation platforms, search/filter endpoints, policy engines, and integrations that accept user-controlled JSONPath expressions.
• Upgrade jsonpath-plus to 10.3.0 or later and rebuild/redeploy all artifacts that bundle it; for Bitnami Hyperledger Fabric Orderer, upgrade to 2.2.7 or later.
• Run dependency and container scans across repositories, CI artifacts, production images, and SBOMs for jsonpath-plus versions before 10.3.0.
• Review application code for jsonpath-plus usage where eval is set to 'safe' or left at defaults, and remove support for arbitrary user-supplied JSONPath filters where possible.
• Add WAF/API gateway or application-layer detections for JSONPath inputs containing JavaScript execution primitives such as constructor chaining, Function constructors, process access, module loading, or child_process usage.
• Hunt historical logs for suspicious JSONPath payloads and runtime evidence of unexpected Node.js child processes, outbound callbacks, secret access, or filesystem modifications.
• Run affected services with least-privileged OS accounts, minimal filesystem permissions, restricted egress, and secrets scoped to only what the service requires.
• If suspicious exploitation is found, rotate credentials available to the affected process, preserve forensic evidence, rebuild from clean images, and investigate downstream systems accessed by those credentials.