Jsonpath-plus vulnerability

Jsonpath-plus vulnerability

Posted by: thierry.kith on 14 October 2024, 11:14 pm EST

• 

  thierry.kith

  • Post Options:
  • Link
    Copy
  • Jump To Answer

  Posted 14 October 2024, 11:14 pm EST - Updated 14 October 2024, 11:19 pm EST

  Hello,

  It seems that the jsonpath-plus dependency has a vulnerability.
  
  Are you planning to update the version (10.0.0 seems to be the one fixing the vulnerability)?

  Best regards.

  

  768×244 8.69 KB

• 

  apowers

  • Post Options:
  • Link
    Copy

  Posted 12 November 2024, 4:39 pm EST

  Any updates?

• 

  katyayny.raghuvanshi

  

  • Post Options:
  • Link
    Copy

  Posted 11 December 2024, 4:45 am EST

  Hi,

  We apologize for the delay in getting back to you. This case somehow got missed by our team. However, we have escalated the same to our development team and will get back to you as soon as we receive any updates from their side [Internal tracking ID: ARJ-6542].

  We heartily appreciate your patience and understanding.

• 

  katyayny.raghuvanshi

  

  • Post Options:
  • Link
    Copy

  Posted 17 December 2024, 5:31 am EST

  Hi,

  jsonpath-plus will be updated to the non-vulnerable v10.1.10 version from ARJS v5.2.0 (ETA: February 14, 2025). We appreciate your patience in the meantime.