You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
SNYK report critical security vulnerability against all version of jsonpath #196
Description
All versions of the package jsonpath are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploit this vulnerability by supplying a malicious JSON Path expression that, when evaluated, executes arbitrary JavaScript code, leading to Remote Code Execution in Node.js environments or Cross-site Scripting (XSS) in browser contexts. This affects all methods that evaluate JSON Paths against objects, including .query, .nodes, .paths, .value, .parent, and .apply.
The CVE link: cve.org/CVERecord?id=CVE-2026-1615 seems to indicate that version 1.2.1 (released February 5th 2026) resolves this issue. Is anyone able to confirm?
I think that this manifests in a different want in 1.2.1, or Synk is just incorrect about that version fixing it because I see the same. When I pulled down the code and did an analysis of it, 1.2.1 also still has the issue.
Thanks for confirming everyone! I would love to help out with a proper fix, but admittedly I'm an amateur JavaScript developer at best and I'm also spread a little thin. That being said I see there is a proposed PR and if there is any way I can help please let me know.
Could someone explain how this vulnerability might be exploited? Because it is a development dependency, it cannot be included in the production build folder. @klyinliu @mikeCapozziICF
Activity
mikeCapozziICF commentedon Feb 6, 2026
I too am receiving this.
afiller commentedon Feb 9, 2026
Any updates on this? It can be critical especially when the lib is used in server environments if I understand it correctly. Thanks in advance.
Kartrag commentedon Feb 12, 2026
Any update on when we can receive fix for this since its Critical
c-goettert commentedon Feb 12, 2026
Please fix this 🙏
klyinliu commentedon Feb 13, 2026
Adding more info:
CVE: https://www.cve.org/CVERecord?id=CVE-2026-1615
adelimon commentedon Feb 17, 2026
Reading up on this, the fix is to allow list only needed expressions in
eval, and error on anything else.maker2413 commentedon Feb 18, 2026
The CVE link: https://www.cve.org/CVERecord?id=CVE-2026-1615 seems to indicate that version 1.2.1 (released February 5th 2026) resolves this issue. Is anyone able to confirm?
chellman commentedon Feb 18, 2026
I don't think that's the case. At least dependabot doesn't think so, listing 1.2.1 and below as vulnerable.
mikeCapozziICF commentedon Feb 19, 2026
@maker2413 - I ran
snyk testand can confirm 1.2.1 does not fix the vulnerability as I have an override to force tht but still get:Arbitrary Code Injection [Critical Severity][https://security.snyk.io/vuln/SNYK-JS-JSONPATH-13645034] in jsonpath@1.2.1
introduced by react-scripts@5.0.1 > bfj@7.1.0 > jsonpath@1.2.1
adelimon commentedon Feb 19, 2026
I think that this manifests in a different want in 1.2.1, or Synk is just incorrect about that version fixing it because I see the same. When I pulled down the code and did an analysis of it, 1.2.1 also still has the issue.
maker2413 commentedon Feb 21, 2026
Thanks for confirming everyone! I would love to help out with a proper fix, but admittedly I'm an amateur JavaScript developer at best and I'm also spread a little thin. That being said I see there is a proposed PR and if there is any way I can help please let me know.
Wajih-Ul-Hasan commentedon Feb 23, 2026
Could someone explain how this vulnerability might be exploited? Because it is a development dependency, it cannot be included in the production build folder.
@klyinliu
@mikeCapozziICF
klyinliu commentedon Feb 24, 2026
Closing the issue as both SNYK and CVE report confirm the issue doesn't apply to version 1.2.0 or 1.2.1
samuelogboye commentedon Feb 24, 2026
@klyinliu I'm still getting the vulnerability alert for 1.2.1, how did you come to that conclusion?
klyinliu commentedon Feb 24, 2026
https://security.snyk.io/vuln/SNYK-JS-JSONPATH-13645034
It mentioned
How to fix?
Upgrade jsonpath to version 1.2.0 or higher.
Also it is gone in our SNYK report. @samuelogboye try re-test and also double check it is actually against 1.2.1 in your project.