JSONPath Plus saw a significant update moving from version 1.1.0 to 2.0.0. Both versions offer a JavaScript implementation of the JSONPath query language, enhanced with additional operators, allowing developers to easily extract data from JSON structures using path expressions. However, version 2.0.0 brings several notable changes in its development dependencies, potentially impacting the development workflow rather than the core functionality directly consumed by users.
A key difference lies in the updated versions of development tools. For instance, eslint, a popular JavaScript linter, jumps from version 6.4.0 to 6.7.0. Similarly, typedoc, used for generating documentation from TypeScript code, moves from 0.15.0 to 0.15.2. Packages like @babel/core and @babel/preset-env, crucial for transpiling modern JavaScript, see updates from 7.6.2 to 7.7.4. Other tools like eslint-plugin-sonarjs, eslint-plugin-unicorn, @mysticatea/eslint-plugin, and eslint-config-ash-nazg also received version bumps, introducing new linting rules and potentially stricter code quality checks.
These updates suggest a focus on enhanced code quality, maintainability, and documentation. While the core API for querying JSON data likely remains consistent, developers contributing to the library or setting up a development environment should be aware of the updated tooling requirements in version 2.0.0. The increased unpackedSize and fileCount in the dist object from version 1.1.0 to 2.0.0 may indicate a more comprehensive build process and potentially improved documentation or testing artifacts included in the package. The release dates also highlight a two-month gap between the releases, suggesting a period of refinement and update incorporation.
All the vulnerabilities related to the version 2.0.0 of the package
JSONPath Plus allows Remote Code Execution
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.
Note:
This is caused by an incomplete fix for CVE-2024-21534.
JSONPath Plus Remote Code Execution (RCE) Vulnerability
Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.
Note:
There were several attempts to fix it in versions 10.0.0-10.1.0 but it could still be exploited using different payloads
