All jsonpath versions

[email protected] rejected Risk: 88 No license

jsonpath @0.2.12

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Homepage Tarball
88
Risk Score
—
License
No
Install Scripts
4
Dependencies
7
Dev Dependencies
91.4 KB
Package Size
Published

Maintainers

dchester

Keywords

JSONPathjsonpathjson-pathobjecttraversaljsonpathdata structures

Dependencies (4)

PackageConstraintRegistry Status
jison 0.4.13 auto_approved
esprima 1.2.2 auto_approved
underscore 1.7.0 No greenflagged match
static-eval 0.2.3 auto_approved

Dev Dependencies (7)

PackageConstraintRegistry Status
jscs 1.10.0 auto_approved
grunt 0.4.5 rejected
mocha 2.1.0 auto_approved
jshint 2.6.0 auto_approved
grunt-cli 0.1.13 auto_approved
grunt-browserify 3.8.0 Not imported
grunt-contrib-uglify 0.9.1 auto_approved

Transitive Dependency Tree

14 transitive deps max depth 4
  ├─ esprima 1.2.2 → 1.2.2
  ├─ jison 0.4.13 → 0.4.13
  ├─ static-eval 0.2.3 → 0.2.3
├─ underscore 1.7.0
  ├─ JSONSelect 0.4.0 → 0.4.0
  ├─ cjson ~0.2.1 → 0.2.1
  ├─ ebnf-parser ~0.1.9 → 0.1.10
  ├─ escodegen 0.0.21 → 0.0.21
  ├─ escodegen ~0.0.24 → 0.0.28
  ├─ esprima 1.0.x → 1.0.4
  ├─ jison-lex 0.2.x → 0.2.1
  ├─ lex-parser ~0.1.3 → 0.1.4
├─ nomnom 1.5.2 → 1.5.2
  ├─ colors 0.5.x → 0.5.1
  ├─ esprima ~1.0.2 → 1.0.4
  ├─ estraverse ~1.3.0 → 1.3.2
  ├─ estraverse ~0.0.4 → 0.0.4
  ├─ lex-parser 0.1.x → 0.1.4
  ├─ nomnom 1.5.2 → 1.5.2
  ├─ source-map >= 0.1.2 → 0.7.6
├─ underscore 1.1.x
  ├─ colors 0.5.x → 0.5.1
  ├─ underscore 1.1.x

SAST Findings (4)

CRITICAL GHSA-87r5-mp6g-5w5j: jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions osv

CVSS 9.8 (CRITICAL) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ### Impact **Arbitrary Code Injection (Remote Code Execution & XSS):** A critical security vulnerability affects **all versions** of the `jsonpath` package. The library relies on the `static-eval` module to evaluate JSON Path expressions but fails to properly sanitize or sandbox the input. This allows an attacker to inject arbitrary JavaScript code into the JSON Path expression. When the library evaluates this expression, the malicious code is executed. * **Node.js Environments:** This leads to **Remote Code Execution (RCE)**, allowing an attacker to compromise the server. * **Browser Environments:** This leads to **Cross-Site Scripting (XSS)**, allowing an attacker to hijack user sessions or exfiltrate data. **Affected Methods:** The vulnerability triggers when untrusted data is passed to any method that evaluates a path, including: * `jsonpath.query` * `jsonpath.nodes` * `jsonpath.paths` * `jsonpath.value` * `jsonpath.parent` * `jsonpath.apply` ### Patches **No Patch Available:** Currently, **all versions** of `jsonpath` are vulnerable. There is no known patched version of this package that resolves the issue while retaining the current architecture. **Recommendation:** Developers are strongly advised to **migrate to a secure alternative** (such as `jsonpath-plus` or similar libraries that do not use `eval`/`static-eval`) or strictly validate all JSON Path inputs against a known allowlist. ### Workarounds * **Strict Input Validation:** Ensure that no user-supplied data is ever passed directly to `jsonpath` functions. * **Sanitization:** If user input is unavoidable, implement a strict parser to reject any JSON Path expressions containing executable JavaScript syntax (e.g., parentheses `()`, script expressions `script:`, or function calls). ### Resources * [CVE-2026-1615](https://nvd.nist.gov/vuln/detail/CVE-2026-1615) * [Vulnerable Code in handlers.js](https://github.com/dchester/jsonpath/blob/c1dd8ec74034fb0375233abb5fdbec51ac317b4b/lib/handlers.js#L243) * [Snyk Advisory (Java/WebJars)](https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15141219) * [Snyk Advisory (JS)](https://security.snyk.io/vuln/SNYK-JS-JSONPATH-13645034)

HIGH Package has 'postinstall' script install-scripts

Script: node lib/aesprim.js > generated/aesprim-browser.js

MEDIUM GHSA-6c59-mwgh-r2x6: JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js osv

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Review Summary

Risk score: 88. Findings: 1 critical (+40), 1 high (+25), 2 medium (+20), 1 low (+3).

Commit: 4960ea572219 Browse source

Published to npm: