Code Injection in JSONPath - CVE-2025-1302

Vulnerability identifier: #VU107638

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-1302

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.

JSONPath
Netcool Operations Insight
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Cloud Pak for Security
App Connect Enterprise Certified Container
Knowledge Catalog Premium Cartridge
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
Event Streams
IBM App Connect Enterprise
Planning Analytics Local
IBM Cloud Pak for Multicloud Management

Install updates from vendor's website.

JSONPath - update to 10.3.0
Netcool Operations Insight - update to 1.6.15
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
Knowledge Catalog Premium Cartridge - update to 5.2
Event Streams - update to 11.7.0
IBM App Connect Enterprise - addressed in versions 12.0.12.12, 13.0.3.0
IBM Cloud Pak for Security - update to 1.11.2.0
Planning Analytics Local - addressed in versions 2.0.0.103, 2.1.10
IBM Cloud Pak for Multicloud Management - update to 2.3 FP11
watsonx Assistant Cartridge - update to 5.1.3
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.3
App Connect Enterprise Certified Container - addressed in versions 12.0.10, 12.11.0

• Exploit #11631 - CVE-2025-1302 (June 13, 2025)

• https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456
• https://github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js%23L127
• https://github.com/JSONPath-Plus/JSONPath/commit/30942896d27cb8a806b965a5ca9ef9f686be24ee
• https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-8719585

• Code Injection in jsonpath-plus
• Multiple vulnerabilities in IBM Cloud Pak for Security
• IBM App Connect Enterprise Certified Container update for jsonpath-plus
• Multiple vulnerabilities in IBM Planning Analytics Local - IBM Planning Analytics Workspace
• IBM Event Streams update for package jsonpath-plus
• Multiple vulnerabilities in IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• Multiple vulnerabilities in IBM Watson Knowledge Catalog
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Knowledge Catalog Premium Cartridge