CVE-2025-61140

What it actually does

The vulnerable value function in dchester jsonpath 1.1.1 does not adequately validate attacker-controlled path/property input before writing into JavaScript objects. An attacker who can influence JSONPath expressions or values processed by the library may be able to assign properties such as __proto__, constructor, or prototype, causing JavaScript prototype pollution. In Node.js applications, prototype pollution can alter behavior across objects, bypass authorization or validation logic, corrupt application data, trigger denial of service, and in vulnerable application patterns potentially lead to code execution. The CVSS 9.8 rating reflects network-reachable exploitation with low complexity, no authentication, and potential high confidentiality, integrity, and availability impact when the library is exposed through application functionality.

Why it matters to the business

Applications that expose jsonpath processing to users, APIs, integrations, workflow engines, configuration importers, or data transformation features may be vulnerable to unauthorized data access, tampering, service disruption, or compromise of business logic. Because jsonpath is a reusable dependency, exposure may exist indirectly through downstream packages or embedded application features rather than direct use by engineering teams. Although EPSS is currently low and no public exploit maturity or KEV listing is reported, the high severity means affected services should be reviewed and remediated promptly, especially where untrusted users can submit JSONPath-like input.

How an attack unfolds

An attacker first finds an application endpoint, job processor, import function, or integration that passes user-controlled JSONPath expressions or assignment values into the vulnerable dchester jsonpath value function. They then craft input that references prototype-related properties, such as __proto__, constructor, or prototype, causing the library to write attacker-chosen properties onto Object.prototype or another shared prototype. Once polluted, newly created objects may inherit malicious defaults. The attacker then abuses application-specific behavior that trusts inherited properties: for example, bypassing security checks, changing configuration flags, corrupting serialized output, forcing exceptions, or influencing template, command, or deserialization paths. The final impact depends on how the host application uses polluted objects, but can range from denial of service and data integrity failures to privilege escalation or remote code execution in unsafe patterns.

How to fix it

Inventory all direct and transitive use of dchester jsonpath, especially version 1.1.1. No fixed version was provided in the input, so treat affected deployments as requiring compensating controls until the maintainer publishes a patched release or an application-level patch is available. If a safe maintained fork or patched release is available from trusted upstream sources, upgrade and regression-test immediately. Where upgrade is not possible, prevent untrusted input from reaching jsonpath value assignment functionality; reject path components named __proto__, prototype, constructor, or similar meta-properties; use allowlists for permitted path syntax; and create objects with null prototypes where practical. Consider replacing the dependency with a maintained JSONPath implementation that explicitly protects against prototype pollution. Restart Node.js processes after remediation because polluted prototypes can persist for the lifetime of a process.

How to confirm the fix worked

Confirm exposure by generating a software bill of materials or dependency tree and checking for dchester jsonpath 1.1.1 in package-lock.json, yarn.lock, pnpm-lock.yaml, npm ls output, bundled JavaScript, or vendor directories. Review code paths to determine whether untrusted users can influence JSONPath expressions, object paths, or values passed to the library's value function. Validate mitigation with a safe test in a non-production environment: attempt to process input containing prototype keys such as __proto__.polluted and verify that {}.polluted remains undefined after processing. Confirm that dependency scans no longer report the affected version or that compensating input validation blocks prototype-pollution keys before library invocation.

Typical attack path

1. Identify an internet-facing or remotely reachable feature that accepts JSON, filtering rules, JSONPath expressions, transformation mappings, or query-like path input.
2. Submit crafted JSONPath/value input containing prototype-pollution keys such as __proto__, constructor, or prototype.
3. Trigger the vulnerable value function in dchester jsonpath 1.1.1 so the application writes attacker-controlled properties to a shared JavaScript prototype.
4. Invoke follow-on application functionality that creates or evaluates objects affected by the polluted prototype.
5. Abuse inherited polluted properties to bypass logic, alter data, crash the process, or reach application-specific code execution primitives.

How to detect it

To determine whether exploitation already occurred, search application access logs, API gateway logs, WAF logs, reverse proxy logs, and application debug/error logs for JSONPath or JSON payloads containing prototype-pollution property names. Focus on endpoints that accept filters, rules, transformations, mappings, import files, workflow definitions, or arbitrary JSON. Review Node.js application logs for unexpected TypeError exceptions, authorization anomalies, configuration values changing unexpectedly, unusual serialized properties appearing across unrelated objects, or sudden process crashes after suspicious requests. If request bodies are logged, look for attempts to set __proto__, constructor.prototype, or prototype properties inside JSONPath expressions or object paths. In memory forensics or live triage, test whether Object.prototype contains unexpected enumerable properties, but perform this carefully because normal runtime inspection can be noisy and application-specific. There are no known KEV or named threat actor indicators in the provided data, so detection should focus on behavioral and input-pattern evidence rather than actor-specific infrastructure.

• __proto__
• constructor.prototype
• constructor[prototype]
• prototype.polluted
• __proto__.polluted
• ["__proto__"]
• ['__proto__']
• ["constructor"]["prototype"]
• ['constructor']['prototype']
• jsonpath
• lib/index.js
• Object.prototype

What your security team should do

• Prioritize internet-facing Node.js services and APIs that accept user-controlled JSONPath, JSON transformation rules, filters, or mapping expressions.
• Run dependency inventory across source repositories, container images, serverless packages, and deployed artifacts for dchester jsonpath 1.1.1.
• If no patched upstream version is available, implement strict input allowlisting and block __proto__, prototype, and constructor path segments wherever JSONPath input is accepted.
• Add regression tests for prototype pollution to affected applications and CI pipelines.
• Monitor application logs and error telemetry for suspicious JSONPath input containing prototype-pollution property names.
• Review authorization, validation, templating, and configuration logic for unsafe reliance on inherited object properties; prefer Object.hasOwn or hasOwnProperty checks.
• Restart affected Node.js services after patching or mitigation to clear any in-memory polluted prototype state.
• Track upstream advisories for a fixed version or maintained replacement and schedule dependency replacement if the package is no longer maintained.