CVE-2026-1615 jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-1615?
CVE-2026-1615 is a critical vulnerability in jsonpath, published on 9 Feb 2026.
Official description
Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploit this vulnerability by supplying a malicious JSON Path expression that, when evaluated, executes arbitrary JavaScript code, leading to Remote Code Execution in Node.js environments or Cross-site Scripting (XSS) in browser contexts. This affects all methods that evaluate JSON Paths against objects, including .query, .nodes, .paths, .value, .parent, and .apply.
Weakness: CWE-94
Which versions are affected by CVE-2026-1615?
2 open source packages ship an affected version, including jsonpath.
| Package | Affected | Fixed in |
|---|---|---|
jsonpath npm | All versions | 1.3.0 |
jsonpath npm | All versions | 1.3.0 |
How do I fix CVE-2026-1615?
Upgrade jsonpath to 1.3.0 or later.
Is CVE-2026-1615 being exploited?
There is no known exploitation of CVE-2026-1615 in the wild and no public exploit code.
Sources
Also known as GHSA-87r5-mp6g-5w5j, ROOT-APP-NPM-CVE-2026-1615.