CVE-2026-1615

What it actually does

The described flaw is an arbitrary JavaScript code injection vulnerability in the jsonpath package before version 1.3.0. When an application evaluates attacker-controlled JSONPath expressions through methods such as .query, .nodes, .paths, .value, .parent, or .apply, unsafe use of static-eval can allow expression content to escape intended JSONPath evaluation and execute JavaScript. In server-side Node.js applications, this can become remote code execution with the privileges of the Node.js process; in browser-bundled use, it can result in script execution in the user’s browser context. The provided affected-product metadata references Linux kernel versions, which is inconsistent with the package description, so teams should validate the advisory mapping in their vulnerability source before relying on product/fix attribution.

Why it matters to the business

If exposed through an API, search/filter feature, rules engine, data transformation workflow, or browser feature that accepts JSONPath input from users, this vulnerability can allow attackers to take control of application behavior, access sensitive data available to the process, modify data, disrupt service, or pivot to other systems using the application’s permissions. Although it is not listed in CISA KEV, has no reported ransomware association, and has a relatively low EPSS score, the CVSS severity is critical because exploitation requires no authentication if untrusted JSONPath input is reachable over the network. The issue has been public for 182 days, increasing the likelihood that scanners and exploit attempts may emerge even where exploit maturity is currently listed as none.

How an attack unfolds

An attacker first identifies an application feature that accepts JSONPath expressions, commonly as a query parameter, request body field, stored rule, report definition, data extraction template, or client-side expression. The attacker submits a crafted JSONPath expression containing JavaScript constructs that the vulnerable jsonpath evaluation path passes into static-eval. Instead of being treated as a harmless selector over JSON data, the expression is evaluated in a way that permits code execution. In a Node.js service, successful exploitation can execute commands or JavaScript within the application process, potentially leading to data theft, application compromise, credential exposure from environment variables, or further lateral movement depending on runtime permissions. In a browser context, the same unsafe evaluation pattern may execute attacker-supplied script, enabling cross-site scripting against users who process the malicious expression.

How to fix it

Upgrade the jsonpath package to version 1.3.0 or later wherever it is used directly or transitively. Regenerate and redeploy dependency lockfiles and application bundles after upgrading. If immediate upgrade is not possible, do not evaluate JSONPath expressions supplied by untrusted users; replace free-form JSONPath input with allowlisted selectors, predefined queries, or a parser/evaluator designed for untrusted input. Apply strict input validation that rejects JavaScript-like constructs, function constructors, module loading references, and other non-selector syntax, but treat validation only as a temporary mitigation. For browser-bundled applications, rebuild assets with the fixed dependency and invalidate caches/CDNs. Because the supplied product metadata also lists Linux kernel fixed version 5.15.145 and git commit 39f5b4b313b445c980a2a295bed28228c29228ed, security teams should verify whether their vulnerability feed has an incorrect package-to-product mapping; if a kernel finding is separately present, remediate it according to the relevant Linux kernel advisory, but do not treat kernel patching as a fix for the described jsonpath package issue.

How to confirm the fix worked

Confirm exposure by inventorying package manifests and lockfiles for jsonpath versions below 1.3.0 using npm, Yarn, pnpm, software composition analysis, container image scans, and bundled JavaScript artifact review. Useful checks include `npm ls jsonpath`, searching package-lock.json, yarn.lock, pnpm-lock.yaml, and SBOMs for `jsonpath`, and verifying that deployed build artifacts no longer include vulnerable versions. Confirm that application code does not pass user-controlled strings into jsonpath methods such as query, nodes, paths, value, parent, or apply. For runtime validation, test with safe non-destructive JSONPath expressions to verify that untrusted users cannot submit arbitrary expressions and that only approved selectors or predefined queries are accepted. If a scanner reports this issue against Linux kernel assets, validate the finding manually because the advisory description and affected-product metadata conflict.

Typical attack path

1. Discover an application endpoint or UI feature that accepts JSONPath expressions from users or external systems.
2. Confirm that the application uses the vulnerable jsonpath package before version 1.3.0 or includes it in a bundled dependency tree.
3. Submit benign JSONPath probes to determine whether expressions are evaluated server-side, client-side, or stored for later execution.
4. Send a malicious JSONPath expression containing unsafe JavaScript evaluation constructs.
5. Achieve code execution in the Node.js process or script execution in a browser context.
6. Use the execution context to read sensitive data, alter application output, access environment variables, invoke network callbacks, or stage additional activity.
7. Cover tracks by blending payloads into normal query/filter traffic or stored rule definitions.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs, API gateway logs, WAF logs, application logs, reverse proxy logs, request-body capture systems, and telemetry from services that accept JSONPath or filter/query expressions. Look for JSONPath parameters or request fields containing JavaScript execution primitives, constructor chaining, references to Node.js process objects, module loading, child process execution, environment variable access, encoded payloads, or unusually long/obfuscated selector strings. Correlate suspicious requests with application errors, stack traces referencing jsonpath or static-eval, unexpected outbound network connections from Node.js processes, spawned shell or interpreter processes, access to sensitive environment variables, and new files written by the application user. For browser contexts, review CSP violation reports, frontend error telemetry, and reports of unexpected script execution tied to JSONPath input. No KEV or named threat actor activity is provided, so detection should focus on behavioral evidence and payload patterns rather than campaign-specific infrastructure.

• static-eval
• jsonpath
• constructor.constructor
• constructor['constructor']
• Function(
• eval(
• process.mainModule
• process.env
• global.process
• require('child_process')
• require("child_process")
• child_process.exec
• child_process.execSync
• child_process.spawn
• child_process.fork
• module.require
• process.binding
• Buffer.from(
• at JSONPath
• jsonpath.query
• jsonpath.nodes
• jsonpath.paths
• jsonpath.value
• jsonpath.parent
• jsonpath.apply
• /bin/sh
• /bin/bash
• cmd.exe
• powershell.exe
• curl
• wget
• nslookup
• whoami
• id
• uname -a

What your security team should do

• Prioritize internet-facing, unauthenticated, multi-tenant, automation, reporting, search, filtering, and data-transformation services that accept JSONPath-like input.
• Upgrade jsonpath to 1.3.0 or later and redeploy affected applications, containers, serverless functions, and browser bundles.
• Search source code for calls to jsonpath .query, .nodes, .paths, .value, .parent, and .apply where the expression argument can be influenced by users or external data.
• Temporarily disable or restrict free-form JSONPath input until patched, especially on unauthenticated endpoints.
• Add dependency policy controls to block jsonpath versions below 1.3.0 in CI/CD and artifact repositories.
• Review logs for suspicious JSONPath payloads containing JavaScript execution primitives, module loading, process access, or encoded equivalents.
• Investigate vulnerability-feed inconsistencies before closing findings, because the provided kernel product mapping does not match the described JavaScript package vulnerability.