CVE-2020-1615 jsonpath Arbitrary Code Injection Vulnerability

Vulnerability Key Information Vulnerability Name Arbitrary Code Injection Affected Package jsonparch Affected Versions All versions Introduced Date 2020-06-20 Vulnerability IDs CVE-2020-1615 CWE-1321 CWE-94 Severity Rating CVSS Base Score: 9.2 CVSS Severity: CRITICAL Threat Intelligence Exploit Maturity: Proof of Concept Vulnerability Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploit this vulnerability by supplying a malicious JSON Path expression that, when evaluated, executes arbitrary JavaScript code, leading to Remote Code Execution in Node.js environments or Cross-site Scripting (XSS) in browser contexts. CVSS Base Scores (Version 4.0) Attack Vector (AV): Network Attack Complexity (AC): Low Attack Requirements (AT): Present Privileges Required (PR): None User Interaction (UI): None Confidentiality (VC): High Integrity (VI): High Availability (VA): High Confidentiality (SC): None Integrity (SI): None Availability (SA): None Additional Information Snyk ID: SNYK-JS-JSONPATH-13645034 Published Date: 2026-02-05 Disclosed Date: 2025-06-20 Credit: Nick Copi

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2020-1615 jsonpath Arbitrary Code Injection Vulnerability