9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-1615

CVE-2026-1615: jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions

Versions of the package jsonpath before 1.2.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploit this vulnerability by supplying a malicious JSON Path expression that, when evaluated, executes arbitrary JavaScript code, leading to Remote Code Execution in Node.js environments or Cross-site Scripting (XSS) in browser contexts. This affects all methods that evaluate JSON Paths against objects, including .query, .nodes, .paths, .value, .parent, and .apply.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-1615

CVE-2026-1615:

9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
jsonpath	npm	<= 1.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the jsonpath library uses an embedded, unsandboxed version of static-eval to evaluate script expressions within JSONPath queries. An attacker can craft a malicious path containing arbitrary JavaScript. When methods like query, nodes, or value process this path, the script expression is parsed into an Abstract Syntax Tree (AST) and passed to static-eval's walk function for evaluation, leading to code execution. This can result in Remote Code Execution (RCE) in a Node.js environment or Cross-Site Scripting (XSS) in a browser.

The patch, introduced in version 1.2.1, mitigates this in two main ways. First, it adds assertion functions (_assert_safe_key, _assert_safe_components) within the jsonpath library itself to validate path components before they are processed. These checks are called from the main public API functions. Second, it hardens the embedded static-eval module by preventing access to sensitive properties like __proto__, prototype, and constructor, which are common vectors for prototype pollution and gadget chain exploitation. The identified vulnerable functions are the public entry points that accept the malicious path and the internal walk function where the code execution is ultimately triggered.

Vulnerable functions

JSONPath.parent

jsonpath.js

The `parent` function processes a user-provided JSONPath string to locate a node and its parent. Prior to the patch, it did not validate the components of the parsed path, allowing a malicious path to be processed by the underlying evaluation engine. The patch introduces the `_assert_safe_path_keys` check to sanitize the path components before they are used.

JSONPath.apply

jsonpath.js

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.