Skip to content
OpenAdvisories

Product · jmespath

jmespath.php

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-54133

    jmespath.php has CompilerRuntime code injection via unescaped function names

    jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `Jm…

    jmespath jmespath.php mtdowling/jmespath.php Packagist