Skip to content
OpenAdvisories

Package · npm

jsonpath

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.8
    CVE-2026-1615

    jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions

    Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle unt…

    jsonpath npm
  • Critical 9.8
    CVE-2025-61140

    JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js

    The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

    jsonpath npm