Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.2

jsonpath: Malicious Code Can Run on Your Server

CVE-2026-1615 · published 1 day ago
Summary

The jsonpath library has a security flaw that allows hackers to run malicious code on your server. This can happen if you use the library to evaluate user input and don't properly check what's being passed in. To stay safe, consider switching to a different library or carefully validating all user input.

What to do
  • Update jsonpath to version 1.3.0.
  • Update jsonpath to version 1.1.1-aikido.1.
  • Update rootio @rootio/jsonpath to version 1.1.1-root.io.1.
  • Update org.webjars.npm:jsonpath to version * or later.
Affected software
Ecosystem VendorProductAffected versions
npm dchester jsonpath <= 1.2.1
npm – jsonpath <= 1.2.1
Fix: upgrade to 1.3.0
– – jsonpath < 1.3.0
– – org.webjars.npm:jsonpath < *
Root:npm – jsonpath < 1.1.1-aikido.1
Fix: upgrade to 1.1.1-aikido.1
Root:npm rootio @rootio/jsonpath < 1.1.1-root.io.1
Fix: upgrade to 1.1.1-root.io.1
Original advisory text
CVE-2026-1615 in jsonpath - Patched by Root
Root has patched CVE-2026-1615 in the jsonpath package for Root:npm. Multiple fixed versions available.
References
Severity
8.2 High
CVSS 3.1: 9.8 (NVD)
CVSS 4.0: 9.2 (NVD)
Exploitation
EPSS 1%
Type
CWE-94Code Injection
Timeline
Published2 Sep 2026
Updated2 Sep 2026
First seen6 Mar 2026
Sources
CVE-2026-1615 · NVD
GHSA-87r5-mp6g-5w5j · GHSA
CVE-2026-1615 · OSV
CVE-2026-1615 · MITRE
ROOT-APP-NPM-CVE-2026-1615 · OSV
Monitor software like this
Free during beta