jsonpath-plus CVEs in Kafka UI 1.4.2: status and remediation

[chyeyun]

Issue submitter TODO list

• I've looked up my issue in FAQ
• I've searched for an already existing issues here
• I've tried running main-labeled docker image and the issue still persists there
• I'm running a supported version of the application which is listed here

Describe the bug (actual behavior)

Hello,

We are currently using Kafka UI (Kafbat) version 1.4.2.

Our security team recently identified vulnerabilities related to the jsonpath-plus package:

CVE-2024-21534
CVE-2025-1302

According to the advisories, these vulnerabilities affect older versions of jsonpath-plus, and CVE-2025-1302 appears to be fully patched starting from version 10.3.0.

Could you please clarify the following?

Is jsonpath-plus updated to a non-vulnerable version in Kafka UI 1.5.0?
If so, is upgrading to Kafka UI 1.5.0 sufficient to remediate these vulnerabilities?
If not, is there any recommended workaround or manual patching procedure for users currently running 1.4.2?
Are there any plans to address these CVEs in an upcoming release?

Thank you for your help and for maintaining the project.

Expected behavior

No response

Your installation details

1. App version : 1.4.2
2. Helm chart version : 1.4.2

Steps to reproduce

This is not a functional bug report but a security-related inquiry.

Steps:

Deploy Kafka UI version 1.4.2.
Scan application dependencies using a vulnerability scanning tool (e.g., SCA/dependency scanner).
Observe that the scanner reports vulnerabilities in the jsonpath-plus package:
CVE-2024-21534
CVE-2025-1302

I would like to confirm whether these vulnerabilities are addressed in Kafka UI 1.5.0 and whether any mitigation or upgrade path is recommended.

Screenshots

No response

Logs

No response

Additional context

No response

[kapybro]

AI Summary

The user reports two CVEs (CVE-2024-21534 and CVE-2025-1302) in the jsonpath-plus package affecting Kafka UI 1.4.2 and asks whether these are resolved in version 1.5.0. The vulnerabilities stem from outdated versions of jsonpath-plus, with CVE-2025-1302 requiring version 10.3.0 or higher for full remediation. The user seeks confirmation on whether upgrading to 1.5.0 resolves the issues or if workarounds or future patches are planned.

[github-actions]

Hi chyeyun! 👋

Welcome, and thank you for opening your first issue in the repo!

Please wait for triaging by our maintainers.

As development is carried out in our spare time, you can support us by sponsoring our activities or even funding the development of specific issues.
Sponsorship link

If you plan to raise a PR for this issue, please take a look at our contributing guide.