fix(deps): update dependency jsonpath-plus to v10.0.7 [security] by renovate-bot · Pull Request #2427 · googleapis/release-please (original) (raw)

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
jsonpath-plus	10.0.0 -> 10.0.7

GitHub Vulnerability Alerts

CVE-2024-21534

Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.

Note:

There was an attempt to fix it in version 10.0.0 but it could still be exploited using different payloads.

Release Notes

s3u/JSONPath (jsonpath-plus)

v10.0.7

Compare Source

• fix(security): prevent constructor access
• docs: add security policy file

v10.0.6

Compare Source

• fix(security): prevent call/apply invocation of Function

v10.0.5

Compare Source

• fix: remove overly aggressive disabling of native functions but
  disallow __proto__

v10.0.4

Compare Source

• fix(security): further prevent binding of Function calls which may evade detection

v10.0.3

Compare Source

• fix(security): prevent binding of Function calls which may evade detection

v10.0.2

Compare Source

• fix(security): prevent Function calls outside of member expressions

v10.0.1

• fix(security): prohibit Function in "safe" vm

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.