Arbitrary Code Injection Vulnerability in jsonpath Package by JsonPath Library

CVE-2026-1615

What is CVE-2026-1615?

The jsonpath package is susceptible to Arbitrary Code Injection due to improper handling of user-supplied JSON Path expressions. This vulnerability arises from the library's reliance on the static-eval module, which does not safely manage untrusted data. Attackers can exploit this flaw by crafting malicious JSON Path expressions that, once evaluated, execute arbitrary JavaScript code. This can lead to serious security risks, including Remote Code Execution in Node.js applications and Cross-site Scripting (XSS) in web browser environments. All methods that evaluate JSON Paths, such as .query, .nodes, .paths, .value, .parent, and .apply, are affected.

References