JSONPath Plus has released a new version, 10.0.4, succeeding the previous stable version, 10.0.3. Both versions are JavaScript implementations of the JSONPath query language, enhanced with additional operators for more flexible and powerful data extraction and manipulation from JSON documents. Developers will appreciate the consistent dependency structure, which includes jsep, @jsep-plugin/regex, and @jsep-plugin/assignment for expression parsing and extended functionality. Development dependencies remain the same covering quality control, testing, documentation, and build processes. These include tools like eslint for code linting, mocha and chai for testing, typedoc for documentation generation, and rollup for bundling.
A subtle difference lies in the dist section. Version 10.0.4 has a slightly larger unpacked size of 610296 bytes compared to 10.0.3's 608973 bytes, a size change that may indicate minor updates or fixes. Additionally, version 10.0.4 was released on "2024-10-17T14:38:08.506Z", slightly later than version 10.0.3, published on "2024-10-17T13:54:28.643Z". These timestamps suggest a relatively quick turnaround, implying that the new release likely addresses some immediate fixes or minor improvements identified shortly after the previous release. Developers should consider these changes when deciding which version to use, potentially opting for the latest version to benefit from the latest bug fixes.
All the vulnerabilities related to the version 10.0.4 of the package
JSONPath Plus Remote Code Execution (RCE) Vulnerability
Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.
Note:
There were several attempts to fix it in versions 10.0.0-10.1.0 but it could still be exploited using different payloads
JSONPath Plus allows Remote Code Execution
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.
Note:
This is caused by an incomplete fix for CVE-2024-21534.
