CVE-2024-21534

The repository contains a functional exploit script for CVE-2024-21534, targeting the jsonpath-plus package's improper input sanitization leading to RCE via Node.js vm module misuse. The script crafts a malicious JSON payload to execute a reverse shell.

This repository contains a functional PoC for CVE-2024-21534, demonstrating RCE in `jsonpath-plus` (<=10.0.7) via unsafe VM module usage in Node.js. The exploit leverages improper input sanitization to execute arbitrary code, with Dockerized setup for reproduction.

This repository contains a functional PoC for CVE-2024-21534, demonstrating RCE in the `jsonpath-plus` package (versions <= 10.0.7) via unsafe evaluation in Node.js's VM module. The exploit includes a vulnerable Express server and a curling app to trigger the vulnerability.