Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-21534-poc — Proof-of-concept exploit for CVE-2024-21534, a critical RCE in jsonpath-plus, demonstrating arbitrary code execution via the VM module and providing mitigation steps. | Kitploit
Tools/GitHubGitHub/bohemianhacks/cve-2024-21534-poc
Vulnerability AnalysisCode AnalysisExploitationWeb Application ExploitationLearning & Education
GitHubbohemianhacks/cve-2024-21534-poc

CVE-2024-21534-poc

Proof-of-concept exploit for CVE-2024-21534, a critical RCE in jsonpath-plus, demonstrating arbitrary code execution via the VM module and providing mitigation steps.

View Repository
111 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Vulnerability: CVE-2024-21534

Severity: Critical (CVSS Score: 9.8)

Description:

The jsonpath-plus package (versions <= 10.0.7) is vulnerable to a Remote Code Execution (RCE) vulnerability that allows attackers to execute arbitrary code via Node.js's VM module. This vulnerability is caused by insufficient input validation and affects versions 10.0.7 and below.

Impact:

Successful exploitation of this vulnerability could lead to complete compromise of the affected system.

Mitigation:

  1. Upgrade jsonpath-plus: Update to version 10.0.8 or later.
  2. Input Validation: Implement strict input validation for JSONPath expressions to prevent malicious input.
  3. VM Module Usage: Minimize the use of the VM module and strictly control its execution environment.
  4. Component Updates: Keep all dependencies up-to-date.
  5. Web Application Firewall (WAF): Deploy a WAF to detect and block web attacks.
  6. Security Audits: Conduct regular security audits to identify and fix vulnerabilities.

References:

  • https://github.com/JSONPath-Plus/JSONPath/issues/226

Note:

This vulnerability was discovered and reported by Andrea Angelo Raineri.

Download Tool