JSONPath Plus, a JavaScript implementation of JSONPath with added operators, saw a minor version update from 5.0.4 to 5.0.5. While the core functionality and description remain consistent between the versions, developers will notice that the primary changes reside within the development dependencies. Both versions share an identical set of development dependencies, including tools for linting (ESLint with a comprehensive suite of plugins like eslint-plugin-jsdoc, eslint-plugin-promise, and eslint-plugin-unicorn, alongside configurations like eslint-config-standard and eslint-config-ash-nazg) testing (Mocha, Chai, nyc), documentation (Typedoc) and code formatting(Remark).
However, the unpackedSize metric in the dist section indicates a slight size increase from 295343 bytes in version 5.0.4 to 295564 bytes in version 5.0.5. While seemingly insignificant, this difference suggests that some underlying code adjustments or updates may have occurred, potentially related to minor bug fixes, internal optimizations, or alterations in the build process of the newer version. Developers should consider upgrading to version 5.0.5 to benefit from these potential improvements, ensuring a smoother and more reliable experience when working with JSONPath expressions in their JavaScript projects. The release date should confirm that 5.0.5 contains latest fixes. The core functionalities and the API should be identical. Developers using a lockfile such as package-lock.json or yarn.lock will need to update their lockfile to reflect the change to version 5.0.5.
All the vulnerabilities related to the version 5.0.5 of the package
JSONPath Plus Remote Code Execution (RCE) Vulnerability
Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.
Note:
There were several attempts to fix it in versions 10.0.0-10.1.0 but it could still be exploited using different payloads
JSONPath Plus allows Remote Code Execution
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.
Note:
This is caused by an incomplete fix for CVE-2024-21534.
