Vanilla JSONEditor has a new version, 1.0.2, released on September 26, 2024, following closely after version 1.0.1, released on September 25, 2024. Both versions offer a web-based tool for viewing, editing, formatting, transforming, and validating JSON data, targeting developers needing a robust JSON manipulation interface. Examining the package.json files reveals subtle yet potentially important differences. The dependency lists are identical, including key libraries like ajv for JSON schema validation, svelte for UI components, and various CodeMirror packages for advanced text editing features such as linting, autocompletion, and language support. This consistency suggests the core functionality remains unchanged. The unpackedSize in the distribution package shows a minor increase from 9057557 bytes in version 1.0.1 to 9057977 bytes in version 1.0.2. While seemingly small, this 420 bytes increasement may indicate bug fixes, performance tweaks, or minor adjustments to assets. Developers considering an upgrade should test their specific use cases to ensure compatibility, though the dependency alignment suggests a smooth transition. The very short time between releases also hints at a hotfix or rapid iteration, so checking the project's changelog or repository for detailed changes is highly recommended.
All the vulnerabilities related to the version 1.0.2 of the package
JSONPath Plus allows Remote Code Execution
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.
Note:
This is caused by an incomplete fix for CVE-2024-21534.
JSONPath Plus Remote Code Execution (RCE) Vulnerability
Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.
Note:
There were several attempts to fix it in versions 10.0.0-10.1.0 but it could still be exploited using different payloads
