Execution Vulnerability in JMESPath for PHP by JMESPath, Inc.

CVE-2026-54133

What is CVE-2026-54133?

The vulnerability in jmespath.php allows for the execution of attacker-controlled PHP code when the JMESPath parser is used with malicious expressions. In versions prior to 2.9.1, unescaped function names can be injected into generated PHP source files. This exploitation can lead to serious security issues as crafted expressions result in the generation of executable PHP code that is subsequently executed by the application. Users are advised to upgrade to version 2.9.1 or later and to disable the 'JP_PHP_COMPILE' option, avoiding the use of 'JmesPath\CompilerRuntime' with any untrusted expressions to mitigate risk.

References