135 matches found
CVE-2026-1615
Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can...
CVE-2026-1615
Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can...
CVE-2026-1615
Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can...
CVE-2026-1615
Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can...
CVE-2026-1615
CVE-2026-1615 affects the jsonpath family (e.g., org.webjars.npm:jsonpath, jsonpath) with Arbitrary Code Injection due to unsafe evaluation of user-supplied JSON Path expressions. The root cause is use of the static-eval module to process JSON Path input, which is not safe for untrusted data, all...
jsonpath 安全漏洞
JSONPath is a JSONPath engine developed by David Chester as an individual contributor. There is a security vulnerability in JSONPath, which stems from the insecure evaluation of JSON Path expressions provided to users. This vulnerability may lead to arbitrary code injection, potentially causing...
SUSE CVE-2025-61140
The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution...
JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js
The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution...
3d-tiles-tools (>=0.1.0 <=0.1.3), 7ghost (>=4.11.0 <=4.11.46) +535 more potentially affected by CVE-2025-61140 via jsonpath (>=0.1.3 <=1.1.1)
jsonpath NPM version =0.1.3, =0.1.0, =4.11.0, =0.0.11, =0.6.0, =0.82.10-20200221024018, =0.1.27, =1.0.0, =1.0.0, =1.1.0, =3.0.6371, =4.0.2, =2.0.4, =0.2.0, =4.0.149, =5.0.257 and more Source cves: CVE-2025-61140 Source advisory: OSV:GHSA-6C59-MWGH-R2X6...
GHSA-6C59-MWGH-R2X6 JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js
The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution...
CVE-2025-61140
A flaw was found in jsonpath. The value function is vulnerable to Prototype Pollution, a type of vulnerability that allows an attacker to inject or modify properties of an object's prototype. This can lead to various impacts, including arbitrary code execution, privilege escalation, or denial of...
Prototype Pollution
Overview org.webjars.npm:jsonpath is a Query JavaScript objects with JSONPath expressions. Robust / safe JSONPath engine for Node.js. Affected versions of this package are vulnerable to Prototype Pollution via the value function. An attacker can modify the prototype of built-in objects by supplyi...
Prototype Pollution
Overview jsonpath is a Query JavaScript objects with JSONPath expressions. Robust / safe JSONPath engine for Node.js. Affected versions of this package are vulnerable to Prototype Pollution via the value function. An attacker can modify the prototype of built-in objects by supplying crafted input...
7ghost (>=4.11.0 <=4.11.46), @accordproject/concerto-ui-react (>=0.6.0 <=0.83.1-20200224151908) +270 more potentially affected by CVE-2025-61140 via jsonpath (>=1.0.0 <=1.1.1)
jsonpath NPM version =1.0.0, =4.11.0, =0.6.0, =0.82.10-20200221024018, =1.0.0, =1.1.0, =3.0.6371, =4.0.2, =2.0.4, =0.2.0, =4.0.149, =3.0.129, =4.0.174, =0.11.8, =1.2.5, =1.4.0 and more Source cves: CVE-2025-61140 Source advisory: SNYK:JS-JSONPATH-15134429...
CVE-2025-61140
The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution...
CVE-2025-61140
The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution...
JSONPath security vulnerabilities
JSONPath is a JSONPath engine developed by David Chester as an individual contributor. There is a security vulnerability in the 1.1.1 version of JSONPath, which stems from prototype pollution in the value function...
EUVD-2025-206486
The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution...
CVE-2025-61140
The CVE-2025-61140 entry concerns jsonpath version 1.1.1, where the value function in lib/index.js is vulnerable to Prototype Pollution. This is documented across multiple sources (GitHub advisory, OSV/NVD entries, and Red Hat advisories) and is categorized with a critical CVSS score. The vulnera...