Critical Command Injection Vulnerability in json-logic-js 2.0.0
Summary
PYSEC-2023-209: A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affects json-logic versions < c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227. Fixed in c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
json-logic-js is an open-source library available on PyPI that provides functionality for working with JSON-based rules. It is commonly used for evaluating and executing logical rules expressed in JSON format. The library is vulnerable to a critical command injection vulnerability in the logic.js file. This vulnerability allows an attacker to manipulate the logic and execute arbitrary commands. The vulnerability has been assigned the identifier CVE-2021-4329 and has a CVSS score of 9.8.
Vulnerability Detail
The command injection vulnerability in json-logic-js 2.0.0 arises due to insufficient input validation and sanitization. An attacker can exploit this vulnerability by crafting malicious JSON logic that includes arbitrary commands. When the logic is evaluated, the commands are executed within the context of the application, leading to potential remote code execution or unauthorized access to sensitive information. This vulnerability poses a significant risk to applications utilizing the affected version of json-logic-js.
How To Fix
Latest published version: 0.6.3 as of 22 Oct 2026
pip install --upgrade "json-logic==0.6.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227
This is the first release that contains the fix.
pip install --upgrade "json-logic==c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement strict input validation and sanitization when processing JSON logic. This includes thoroughly validating and filtering any user-supplied input to prevent the injection of malicious commands. Here is an example of how input validation can be performed in Python:
import json
def validate_json_logic(json_logic):
try:
json.loads(json_logic)
return True
except ValueError:
return False
Conclusion
The command injection vulnerability in json-logic-js 2.0.0 poses a significant risk to applications utilizing this version. It is crucial to upgrade to version 2.0.1 or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for json-logic →
FAQ
json-logic-js is an open-source library that provides functionality for working with JSON-based rules. It allows developers to evaluate and execute logical rules expressed in JSON format.
This vulnerability allows an attacker to execute arbitrary commands within the context of the application. This can lead to remote code execution or unauthorized access to sensitive information.
To fix this vulnerability, it is recommended to upgrade the json-logic-js package to version 2.0.1. This version includes a patch that addresses the command injection vulnerability.
As a temporary workaround, you can implement strict input validation and sanitization when processing JSON logic. This can help prevent the injection of malicious commands.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
