fix(editor): Replace jsonpath with jsonpath-plus to resolve CVE (#26408)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: shortstacked

packages/frontend/editor-ui/package.json

@@ -78,7 +78,7 @@
     "flatted": "catalog:",
     "highlight.js": "catalog:frontend",
     "humanize-duration": "^3.27.2",
-    "jsonpath": "^1.2.0",
+    "jsonpath-plus": "^10.3.0",
     "lodash": "catalog:",
     "luxon": "catalog:",
     "n8n-workflow": "workspace:*",
@@ -122,7 +122,6 @@
     "@types/file-saver": "^2.0.1",
     "@types/humanize-duration": "^3.27.1",
     "@types/json-schema": "^7.0.15",
-    "@types/jsonpath": "^0.2.0",
     "@types/lodash": "catalog:",
     "@types/uuid": "catalog:",
     "@vitejs/plugin-legacy": "^7.2.1",

packages/frontend/editor-ui/src/app/composables/useDataSchema.test.ts

@@ -1,4 +1,4 @@
-import jp from 'jsonpath';
+import { JSONPath } from 'jsonpath-plus';
 import { useDataSchema, useFlattenSchema, type SchemaNode } from './useDataSchema';
 import type { INodeUi, Schema } from '@/Interface';
 import type { IExecutionResponse } from '@/features/execution/executions/executions.types';
@@ -300,10 +300,10 @@ describe('useDataSchema', () => {
 		it('should return the correct data when using the generated json path on an object', () => {
 			const input = { people: ['Joe', 'John'] };
 			const schema = getSchema(input);
-			const pathData = jp.query(
-				input,
-				`$${((schema.value as Schema[])[0].value as Schema[])[0].path}`,
-			);
+			const pathData = JSONPath({
+				path: `$${((schema.value as Schema[])[0].value as Schema[])[0].path}`,
+				json: input,
+			});
 			expect(pathData).toEqual(['Joe']);
 		});
 
@@ -313,20 +313,20 @@ describe('useDataSchema', () => {
 				{ name: 'Joe', age: 33, hobbies: ['skateboarding', 'gaming'] },
 			];
 			const schema = getSchema(input);
-			const pathData = jp.query(
-				input,
-				`$${(((schema.value as Schema[])[0].value as Schema[])[2].value as Schema[])[1].path}`,
-			);
+			const pathData = JSONPath({
+				path: `$${(((schema.value as Schema[])[0].value as Schema[])[2].value as Schema[])[1].path}`,
+				json: input,
+			});
 			expect(pathData).toEqual(['traveling']);
 		});
 
 		it('should return the correct data when using the generated json path on a list of list', () => {
 			const input = [[1, 2]];
 			const schema = getSchema(input);
-			const pathData = jp.query(
-				input,
-				`$${((schema.value as Schema[])[0].value as Schema[])[1].path}`,
-			);
+			const pathData = JSONPath({
+				path: `$${((schema.value as Schema[])[0].value as Schema[])[1].path}`,
+				json: input,
+			});
 			expect(pathData).toEqual([2]);
 		});
 
@@ -338,10 +338,10 @@ describe('useDataSchema', () => {
 				],
 			];
 			const schema = getSchema(input);
-			const pathData = jp.query(
-				input,
-				`$${(((schema.value as Schema[])[0].value as Schema[])[1].value as Schema[])[1].path}`,
-			);
+			const pathData = JSONPath({
+				path: `$${(((schema.value as Schema[])[0].value as Schema[])[1].value as Schema[])[1].path}`,
+				json: input,
+			});
 			expect(pathData).toEqual([33]);
 		});
 
@@ -355,15 +355,15 @@ describe('useDataSchema', () => {
 				},
 			];
 			const schema = getSchema(input);
-			const pathData = jp.query(
-				input,
-				`$${
+			const pathData = JSONPath({
+				path: `$${
 					(
 						(((schema.value as Schema[])[0].value as Schema[])[0].value as Schema[])[0]
 							.value as Schema[]
 					)[0].path
 				}`,
-			);
+				json: input,
+			});
 			expect(pathData).toEqual([new Date('2022-11-22T00:00:00.000Z')]);
 		});
 

packages/frontend/editor-ui/src/features/ndv/runData/components/RunDataJsonActions.vue

@@ -1,5 +1,5 @@
 <script lang="ts" setup>
-import jp from 'jsonpath';
+import { JSONPath } from 'jsonpath-plus';
 import type { INodeUi } from '@/Interface';
 import type { IDataObject } from 'n8n-workflow';
 import { clearJsonKey, convertPath } from '@/app/utils/typesUtils';
@@ -83,7 +83,7 @@ function getJsonValue(): string {
 		const jsonPath = normalisedJsonPath.value.startsWith('$')
 			? normalisedJsonPath.value
 			: `$${normalisedJsonPath.value}`;
-		selectedValue = jp.query(props.jsonData, jsonPath)[0];
+		selectedValue = JSONPath({ path: jsonPath, json: props.jsonData })[0];
 	}
 
 	let value = '';