Versions of the package jsonpath-plus before 10.0.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.
Note:
The unsafe behavior is still available after applying the fix but it is not turned on by default.
Release Notes
s3u/JSONPath (jsonpath-plus)
### [`v10.0.0`](https://redirect.github.com/s3u/JSONPath/blob/HEAD/CHANGES.md#1000)
BREAKING CHANGES:
- Require Node 18+
- fix(security): use safe vm by default in Node
- chore: bump jsep, devDeps. and lint
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
[ ] If you want to rebase/retry this PR, check this box
This PR contains the following updates:
9.0.0->10.0.0GitHub Vulnerability Alerts
CVE-2024-21534
Versions of the package jsonpath-plus before 10.0.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.
Note:
The unsafe behavior is still available after applying the fix but it is not turned on by default.
Release Notes
s3u/JSONPath (jsonpath-plus)
### [`v10.0.0`](https://redirect.github.com/s3u/JSONPath/blob/HEAD/CHANGES.md#1000) BREAKING CHANGES: - Require Node 18+ - fix(security): use safe vm by default in Node - chore: bump jsep, devDeps. and lintConfiguration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.