jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions

🗓️ 09 Feb 2026 06:30:28Reported by GitHub Advisory DatabaseType

jsonpath allows code injection via unsafe JSON Path evaluation, enabling remote or cross site scripting risks.

Reporter	Title	Published	Views	Family All 52
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container is vulnerable to remote code execution (CVE-2026-1615)	26 Mar 202613:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to Arbitrary Code Injection due to Node js module jsonpath (CVE-2026-1615)	20 Apr 202608:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues	26 Feb 202603:04	–	ibm
ATTACKERKB	CVE-2026-1615	9 Feb 202605:00	–	attackerkb
Circl	CVE-2026-1615	9 Feb 202605:18	–	circl
CNNVD	jsonpath 安全漏洞	9 Feb 202600:00	–	cnnvd
CVE	CVE-2026-1615	9 Feb 202605:00	–	cve
Cvelist	CVE-2026-1615	9 Feb 202605:00	–	cvelist
NVD	CVE-2026-1615	9 Feb 202605:16	–	nvd
Tenable Nessus	openSUSE 16 Security Update : golang-github-prometheus-prometheus (openSUSE-SU-2026:20239-1)	19 Feb 202600:00	–	nessus

Vulners

Node

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-1615
security	www.security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15141219
security	www.security.snyk.io/vuln/SNYK-JS-JSONPATH-13645034
github	www.github.com/dchester/jsonpath/blob/c1dd8ec74034fb0375233abb5fdbec51ac317b4b/lib/handlers.js
github	www.github.com/dchester/jsonpath/pull/197
github	www.github.com/dchester/jsonpath/commit/491e2e01de2ff13f7d95e87eb2be726edbf4225f
github	www.github.com/dchester/jsonpath/commit/b61111f07ac1a8d0f3133b5fc51438ecb76a6c39
github	www.github.com/advisories/GHSA-87r5-mp6g-5w5j

19 Mar 2026 16:17Current

6.2Medium risk

Vulners AI Score6.2

CVSS 49.2

CVSS 3.19.8

EPSS0.00107

SSVC