CVE-2025-1302

The vulnerability in the jsonpath-plus package arises from improper input sanitization, specifically in its handling of user-supplied data. This flaw allows an attacker to execute arbitrary code on a system that utilizes this library, particularly when the library is configured to use the unsafe default of eval='safe' mode. The underlying issue stems from an incomplete fix of a prior vulnerability, indicating that the remediation efforts were insufficient to address the root cause of the problem. As a result, the library fails to adequately restrict the execution of potentially malicious code, enabling attackers to manipulate the execution flow and gain unauthorized access to system resources.

Exploitation of this vulnerability can occur through various attack vectors, primarily involving the injection of crafted input into applications that rely on jsonpath-plus for processing JSON data. An attacker could leverage this flaw by sending specially crafted JSON requests to a vulnerable application, which would then be parsed and evaluated by the jsonpath-plus library. For instance, if an application exposes an API endpoint that directly processes user input without proper validation or sanitization, an attacker could exploit this to execute arbitrary commands on the server. This could lead to severe consequences, including data exfiltration, system compromise, or lateral movement within the network.

The real-world impact of this vulnerability is significant, particularly for organizations that utilize jsonpath-plus in their applications without adequate security measures. Given the high CVSS score of 9.8, the risk associated with this vulnerability is categorized as critical. Organizations could face substantial financial losses due to data breaches, legal liabilities, and damage to their reputation. Furthermore, the potential for attackers to gain control over affected systems poses a serious threat to the integrity and confidentiality of sensitive information. The implications extend beyond immediate financial repercussions, as the trust of customers and stakeholders may be irreparably damaged.

To detect and mitigate this vulnerability, organizations should implement a multi-faceted approach. First and foremost, updating to the latest version of jsonpath-plus is essential, as this version includes patches that address the vulnerability. Regularly reviewing and applying security updates for all third-party libraries is a best practice that can significantly reduce exposure to known vulnerabilities. Additionally, organizations should conduct thorough code reviews and security assessments of applications that utilize jsonpath-plus, ensuring that user input is properly validated and sanitized before processing. Employing web application firewalls (WAFs) can also help detect and block malicious input patterns that may attempt to exploit this vulnerability.

In conclusion, the improper input sanitization vulnerability within the jsonpath-plus package presents a critical risk to organizations that utilize this library in their applications. The potential for remote code execution underscores the need for robust security practices, including timely updates, thorough input validation, and proactive monitoring. By adopting a comprehensive security strategy, organizations can mitigate the risks associated with this vulnerability and protect their systems from potential exploitation.

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting the jsonpath-plus vulnerability CVE-2025-1302. This increase is accompanied by the emergence of new proof-of-concept exploits on public repositories, broadening the accessibility of attack tools to a wider range of threat actors. Our telemetry indicates that the EPSS score for this vulnerability has inched higher, reflecting a sustained and slightly elevated risk of exploitation in the near term. Although the rapid increase phase has stabilized, the persistence of active exploitation attempts underscores the criticality of this vulnerability. For defenders, this development signals an urgent need to prioritize monitoring for anomalous behaviors related to jsonpath-plus usage, as the expanding exploit landscape lowers the barrier for adversaries to execute remote code. Consequently, the threat level associated with CVE-2025-1302 has intensified from a latent risk to an actively exploited condition, warranting heightened vigilance in environments where this package is present.

Update 2 — June 20, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2025-1302, despite a significant decline in the EPSS score suggesting reduced overall exploit probability. This divergence indicates that while broad automated scanning may be waning, targeted adversaries continue to actively probe and exploit vulnerable jsonpath-plus instances. The emergence of multiple new proof-of-concept exploits on public repositories further lowers the technical barrier for attackers, increasing the likelihood of opportunistic exploitation across diverse environments. Our telemetry reveals a doubling in detection frequency, signaling persistent attacker interest and operational activity. This evolving landscape elevates the threat posture from controlled risk to sustained active exploitation, underscoring the necessity for defenders to maintain heightened situational awareness and prioritize detection of anomalous behaviors linked to this vulnerability.