CVE-2026-1615 Details

A vulnerability allowing arbitrary code injection has been identified in all versions of the jsonpath package. This issue arises from the library's unsafe evaluation of user-supplied JSON Path expressions, relying on the static-eval module, which cannot securely handle untrusted data. An attacker can exploit this vulnerability by providing a malicious JSON Path expression that executes arbitrary JavaScript code when evaluated. This could lead to remote code execution in Node.js environments or cross-site scripting (XSS) in browser contexts. The vulnerability affects all methods that evaluate JSON Paths against objects, including .query, .nodes, .paths, .value, .parent, and .apply.