Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Upgrade JSON-Path-Plus to V10.2.0. #403

Merged
merged 2 commits into from
Nov 21, 2024

Conversation

danish-khan-I
Copy link
Contributor

This pull request updates the jsonpath-plus dependency to version 10.2.0 to address a critical Remote Code Execution (RCE) vulnerability (CVE-2024-21534) Affecting jsonpath-plus package, versions <10.2.0. The vulnerability stems from improper input sanitization in earlier versions, allowing attackers to execute arbitrary code by exploiting the unsafe default use of the Node.js vm module.

Changes:

  • Upgraded jsonpath-plus to version 10.2.0 in package.json to leverage the latest security patches and improvements.
  • Ran dependency audits and verified compatibility with existing functionality.

Benefits:

  • Fixes a critical security issue (CVSS 9.8), reducing the risk of exploitation.
  • Ensures safer handling of JSONPath queries within the application.

Testing:

  • All relevant tests were executed to confirm no regression in functionality.
  • Security-focused tests confirmed the resolution of known vulnerabilities.

@danish-khan-I
Copy link
Contributor Author

Hi @CacheControl , just wanted to follow up on the PR I submitted to upgrade jsonpath-plus to version 10.2.0. This update addresses a critical security vulnerability (CVE-2024-21534), and I wanted to ensure it doesn’t get overlooked. Please let me know if you need any further information or changes from my side.

@chris-pardy chris-pardy merged commit 00061ac into CacheControl:master Nov 21, 2024
3 checks passed
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants