CVE Intelligence
Analysis AI-assisted

CVE-2025-61140: Dchester jsonpath Prototype Pollution in value function

CVE-2025-61140 describes a Prototype Pollution weakness (CWE-1321) in the value function of lib/index.js in jsonpath version 1.1.1. The NVD record carries a CVSS 3.1 base score of 9.8 and a critical severity label. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-61140 affects the value function in lib/index.js of the jsonpath library, version 1.1.1. The record classifies it as Prototype Pollution (CWE-1321). Prototype pollution occurs when attacker-influenced input can modify properties of base object prototypes, which may change application behaviour. The record was published on 2026-01-28 and has status Analyzed in NVD.

Impact

  • The record lists a CVSS 3.1 base score of 9.8 (critical) from one provider and 8.8 from another.
  • The CVSS metrics in the record indicate high impact on confidentiality, integrity and availability, with no privileges or user interaction required.
  • In general, prototype pollution can lead to unexpected logic changes, denial of service or bypassed checks, depending on how an application uses the affected code. How this applies to a specific deployment is an inference that requires local review.

Affected products and versions

  • Product listed: Dchester Jsonpath, version 1.1.1.
  • The record does not list other affected versions or any fixed version. Review the upstream repository and vendor advisories before deciding which releases are safe.

Exploitation status

  • The record indicates the CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation in the wild appears in the sources consulted. This does not prove that exploitation does not occur.
  • The record contains no EPSS data.

Remediation and mitigation

  • No fixed version is listed in the record. The absence of a listed fix does not mean none exists. Monitor the upstream project and the Red Hat CVE page, which is listed among the references.
  • Identify every place jsonpath 1.1.1 is used, including transitive dependencies in applications and build tooling.
  • Where no update is available, reduce exposure by limiting which input reaches the affected function and rejecting object keys that target prototypes.
  • Test any update in a staging environment before production rollout.

Detection guidance

  • Inventory dependency manifests and lock files to locate jsonpath at version 1.1.1.
  • Review application logs for unusual object keys or structures in data processed through jsonpath-based logic.
  • Monitor for unexpected application behaviour that could result from altered object prototypes.

Limitations of the available information

  • The record does not describe the exact conditions or code path needed to trigger the issue.
  • The record has no fixed version, no EPSS score and no SSVC data.
  • Two CVSS scores with different values are listed, and the record does not explain the difference.

Frequently asked questions

Is CVE-2025-61140 being actively exploited?

The record indicates it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. This is not proof that exploitation does not occur, so monitoring remains advisable.

Which version is affected and is there a fix?

The record lists Dchester Jsonpath version 1.1.1 and no fixed version. The missing fix information does not mean no fix exists, so check the upstream repository and vendor advisories.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.