cve-2025-1302

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "critical"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SUSE CVE-2025-1302",
        "title": "Title"
      },
      {
        "category": "description",
        "text": "Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.\r\r**Note:**\r\rThis is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).",
        "title": "Description of the CVE"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "CVE-2025-1302",
        "url": "https://www.suse.com/security/cve/CVE-2025-1302"
      },
      {
        "category": "external",
        "summary": "SUSE Security Ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "external",
        "summary": "SUSE Bug 1237263 for CVE-2025-1302",
        "url": "https://bugzilla.suse.com/1237263"
      }
    ],
    "title": "SUSE CVE CVE-2025-1302",
    "tracking": {
      "current_release_date": "2025-02-18T05:12:08Z",
      "generator": {
        "date": "2025-02-18T05:12:08Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf-vex.pl",
          "version": "1"
        }
      },
      "id": "CVE-2025-1302",
      "initial_release_date": "2025-02-18T05:12:08Z",
      "revision_history": [
        {
          "date": "2025-02-18T05:12:08Z",
          "number": "2",
          "summary": "Current version"
        }
      ],
      "status": "interim",
      "version": "2"
    }
  }
}