Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

jsonpath-plus may allow code execution

CVE-2025-1302 · published 2 days ago
Summary

The jsonpath-plus library used in several npm packages can be exploited to run unauthorized code. Root has released updated versions that fix the problem. Update to the latest patched version of jsonpath-plus as soon as possible.

What to do
  • Update 80avin jsonpath-plus to version 10.3.0.
  • Update rootio @rootio/jsonpath-plus to version 7.2.0-root.io.5.
  • Update 80avin jsonpath-plus to version 7.2.0-aikido.5.
  • Update 80avin jsonpath-plus to version 7.2.0-aikido.6.
  • Update rootio @rootio/jsonpath-plus to version 7.2.0-root.io.6.
  • Update jsonpath-plus to version 6.0.1-aikido.1.
  • Update rootio @rootio/jsonpath-plus to version 6.0.1-root.io.1.
Affected software
Ecosystem VendorProductAffected versions
npm 80avin jsonpath-plus < 10.3.0
Fix: upgrade to 10.3.0
Root:npm rootio @rootio/jsonpath-plus < 7.2.0-root.io.5
< 7.2.0-root.io.6
< 6.0.1-root.io.1
Fix: upgrade to 7.2.0-root.io.5
Root:npm 80avin jsonpath-plus < 7.2.0-aikido.5
< 7.2.0-aikido.6
Fix: upgrade to 7.2.0-aikido.5
Root:npm – jsonpath-plus < 6.0.1-aikido.1
Fix: upgrade to 6.0.1-aikido.1
Original advisory text
CVE-2025-1302 in jsonpath-plus - Patched by Root
Root has patched CVE-2025-1302 in the jsonpath-plus package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
10% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published6 Nov 2026
Updated6 Nov 2026
First seen6 Mar 2026
Sources
GHSA-hw8r-x6gr-5gjp · GHSA
CVE-2025-1302 · NVD
ROOT-APP-NPM-CVE-2025-1302 · OSV
CVE-2025-1302 · OSV
Track software like this
Free during beta