CVE-2024-21534: Jsonpath-Plus Jsonpath

Critical severity, CVSS 9.8. EPSS: 9% chance of exploitation in the next 30 days.

All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. **Note:** There were several attempts to fix it in versions [10.0.0-10.1.0](https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0) but it could still be exploited using [different payloads](https://github.com/JSONPath-Plus/JSONPath/issues/226).

Affected products

• Jsonpath-Plus Jsonpath: before 10.0.7 (fixed in 10.0.7)

Published 2024-10-11. Last modified 2026-06-17.