JSONPath Plus is a JavaScript library implementing JSONPath syntax, empowering developers to query and extract data from JSON structures with ease. Versions 5.0.1 and 5.0.2, while seemingly close, offer subtle yet noteworthy differences. The primary distinction lies in the dist field; version 5.0.2 shows a slightly larger unpackedSize of 294737 bytes compared to 294639 bytes in version 5.0.1. This minor increase suggests possible refinements in the codebase or bundled assets between the two releases. Both versions share identical development dependencies, encompassing tools for linting (ESLint), testing (Mocha, Chai, NYC), building (Rollup), documentation (Typedoc), and code formatting (Remark). The consistent use of these tools underscores the maintainer's commitment to code quality, testing rigor, and up-to-date documentation. Developers leveraging JSONPath Plus benefit from a rich set of features, including extended operators beyond the standard JSONPath syntax. Furthermore, the comprehensive suite of devDependencies ensures the library is actively maintained and adheres to modern JavaScript coding standards through automated linting, testing, and code formatting. The presence of tools like eslint-plugin-unicorn indicates attention to writing clean and maintainable code. The inclusion of core-js-bundle signifies support for older browsers, broadening the library's compatibility. Upgrading from an earlier version to 5.0.2 should be straightforward and is recommended to get the latest refinements.
All the vulnerabilities related to the version 5.0.2 of the package
JSONPath Plus allows Remote Code Execution
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.
Note:
This is caused by an incomplete fix for CVE-2024-21534.
JSONPath Plus Remote Code Execution (RCE) Vulnerability
Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.
Note:
There were several attempts to fix it in versions 10.0.0-10.1.0 but it could still be exploited using different payloads
