CVE-2026-1615: jsonpath (JavaScript) Arbitrary Code Injection via Unsafe JSON Path Evaluation
CVE-2026-1615 affects versions of the jsonpath package before 1.3.0, which evaluate user-supplied JSON Path expressions through the static-eval module. A crafted expression can lead to arbitrary JavaScript execution, with the record describing impact as Remote Code Execution in Node.js and XSS in browsers. The record rates it critical with CVSS 3.1 score 9.8 and lists no confirmed exploitation.
Overview
CVE-2026-1615 is a code injection weakness (CWE-94) in the jsonpath package for JavaScript. According to the record, the library passes JSON Path input to the static-eval module, which is not designed to handle untrusted data safely. The vulnerability is described as affecting versions before 1.3.0. The upstream fix is referenced in the GitHub commit.
Impact
The record describes two outcomes from a malicious JSON Path expression: arbitrary JavaScript execution leading to Remote Code Execution in Node.js environments, and Cross-site Scripting in browser contexts. The CVSS 3.1 vector given is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which corresponds to a network-reachable issue requiring no privileges or user interaction. Snyk also lists a CVSS 4.0 score of 8.2 in the record.
Affected products and versions
- The record describes the jsonpath package as affected in versions before 1.3.0.
- The description states that all methods evaluating JSON Paths against objects are involved, including .query, .nodes, .paths, .value, .parent and .apply.
- The record contains no structured list of affected versions, so the exact range should be confirmed against the Snyk advisory and the vendor references.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so active exploitation is not confirmed by that source. The EPSS probability is 0.01166 with a percentile of 0.66494. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Upgrade the jsonpath package to version 1.3.0 or later, which the description implies is the first unaffected release.
- Review the Red Hat CVE record and the errata listed in the references for downstream packaging updates.
- Until patching is complete, avoid passing untrusted or user-supplied JSON Path expressions to this library, and validate or restrict such input at the application boundary.
- Re-scan dependencies and transitive packages, since the affected library may be embedded in other products.
Detection guidance
- Inventory projects and container images for the jsonpath package and record installed versions, including transitive dependencies.
- Flag builds or deployments where the version is below 1.3.0.
- Monitor application logs for unusual or unexpected JSON Path query strings that come from external users.
Limitations of the available information
The record has no structured affected or fixed version fields, so the fixed version is inferred from the description and not explicitly confirmed. The source status is shown as Deferred, and the CVSS scores come from Snyk and a second provider without an NVD-specific assessment in the record. No proof-of-concept details are provided here, and the exact exploitation conditions in browser and Node.js contexts are not described in detail.
Frequently asked questions
Which versions of jsonpath are affected by CVE-2026-1615?
The record describes versions before 1.3.0 as vulnerable. It does not provide a structured affected version list, so confirm against the vendor and Snyk references.
Is CVE-2026-1615 being actively exploited?
The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.
What is the recommended action?
Upgrade jsonpath to version 1.3.0 or later, which the description implies is unaffected, and limit untrusted JSON Path input until patching is complete.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.