Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

jsonpath-plus may let attackers execute code

CVE-2024-21534 · published 24 days ago
Summary

The jsonpath-plus library used in several web projects has a flaw that could allow an attacker to run unwanted code on your server. This affects any application that includes jsonpath-plus from the listed sources. Update to the latest patched version of the library as soon as possible.

What to do
  • Update 80avin jsonpath-plus to version 10.2.0.
  • Update rootio @rootio/jsonpath-plus to version 7.2.0-root.io.6.
  • Update 80avin jsonpath-plus to version 7.2.0-aikido.6.
  • Update jsonpath-plus to version 0.19.0-aikido.1.
  • Update rootio @rootio/jsonpath-plus to version 0.19.0-root.io.1.
Affected software
Ecosystem VendorProductAffected versions
maven webjars org.webjars.npm:jsonpath-plus <= 6.0.1
npm 80avin jsonpath-plus < 10.2.0
Fix: upgrade to 10.2.0
Root:npm rootio @rootio/jsonpath-plus < 7.2.0-root.io.6
< 0.19.0-root.io.1
Fix: upgrade to 7.2.0-root.io.6
Root:npm 80avin jsonpath-plus < 7.2.0-aikido.6
Fix: upgrade to 7.2.0-aikido.6
Root:npm – jsonpath-plus < 0.19.0-aikido.1
Fix: upgrade to 0.19.0-aikido.1
Original advisory text
CVE-2024-21534 in jsonpath-plus - Patched by Root
Root has patched CVE-2024-21534 in the jsonpath-plus package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
9% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published25 Sep 2026
Updated15 Oct 2026
First seen6 Mar 2026
Sources
GHSA-pppg-cpfq-h7wr · GHSA
CVE-2024-21534 · NVD
ROOT-APP-NPM-CVE-2024-21534 · OSV
Track software like this
Free during beta