Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security Fix: Address Critical CVE in cyberchef-node by Upgrading jsonpath-plus to v10.0.0 or Higher #1928

Open
mayyagoldman opened this issue Oct 20, 2024 · 0 comments

Comments

@mayyagoldman
Copy link

Issue Description:

cyberchef-node is currently using jsonpath-plus version ^7.2.0, which has a known vulnerability identified as CVE-2024-21534. This vulnerability poses security risks, and it is recommended to upgrade to at least version 10.0.0 where the issue has been addressed.

Proposed Solution:

Update the jsonpath-plus dependency in package.json to ^10.0.0 or later.

Steps to Reproduce:

Inspect package.json to find jsonpath-plus at version ^7.2.0.
Run security scans to confirm vulnerability (CVE-2024-21534).

References:
CVE-2024-21534

jsonpath-plus v10.0.0 release notes

Expected Outcome:
After upgrading, the project should no longer be vulnerable to CVE-2024-21534, and all functionalities depending on jsonpath-plus should remain intact.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant