GHSA-87r5-mp6g-5w5j

Source

https://github.com/advisories/GHSA-87r5-mp6g-5w5j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-87r5-mp6g-5w5j/GHSA-87r5-mp6g-5w5j.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-87r5-mp6g-5w5j

Aliases

CVE-2026-1615

Published

2026-02-09T06:30:28Z

Modified

2026-02-22T23:23:03.217012Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions

Details

Impact

Arbitrary Code Injection (Remote Code Execution & XSS):

A critical security vulnerability affects all versions of the jsonpath package. The library relies on the static-eval module to evaluate JSON Path expressions but fails to properly sanitize or sandbox the input.

This allows an attacker to inject arbitrary JavaScript code into the JSON Path expression. When the library evaluates this expression, the malicious code is executed.

Node.js Environments: This leads to Remote Code Execution (RCE), allowing an attacker to compromise the server.
Browser Environments: This leads to Cross-Site Scripting (XSS), allowing an attacker to hijack user sessions or exfiltrate data.

Affected Methods:

The vulnerability triggers when untrusted data is passed to any method that evaluates a path, including:

jsonpath.query
jsonpath.nodes
jsonpath.paths
jsonpath.value
jsonpath.parent
jsonpath.apply

Patches

No Patch Available:

Currently, all versions of jsonpath are vulnerable. There is no known patched version of this package that resolves the issue while retaining the current architecture.

Recommendation:

Developers are strongly advised to migrate to a secure alternative (such as jsonpath-plus or similar libraries that do not use eval/static-eval) or strictly validate all JSON Path inputs against a known allowlist.

Workarounds

Strict Input Validation: Ensure that no user-supplied data is ever passed directly to jsonpath functions.
Sanitization: If user input is unavoidable, implement a strict parser to reject any JSON Path expressions containing executable JavaScript syntax (e.g., parentheses (), script expressions script:, or function calls).

Resources

Database specific

{
    "nvd_published_at": "2026-02-09T05:16:24Z",
    "github_reviewed_at": "2026-02-12T15:29:55Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-94"
    ],
    "severity": "HIGH"
}

References

Affected packages

npm / jsonpath

Package

Name: jsonpath; View open source insights on deps.dev
Purl: pkg:npm/jsonpath

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.2.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-87r5-mp6g-5w5j/GHSA-87r5-mp6g-5w5j.json"