Junglewise Threat Intelligence

CVE-2025-61140: dchester jsonpath prototype pollution in value function

CVE-2025-61140 · Severity: critical · CVSS 9.8 · Published 2026-01-28

Technologies: Red Hat Enterprise Linux AI (RHEL AI), Dchester Jsonpath, Red Hat Developer Hub. Vendors: Red Hat, Dchester.

Executive brief

A vulnerability exists in the jsonpath library, a tool used by developers to search and manipulate data within JavaScript objects. This library is integrated into several enterprise products, including Red Hat Ansible Automation Platform and OpenShift. An attacker could exploit this flaw to modify the underlying behavior of the application, potentially leading to unauthorized data access, service disruption, or full system takeover.

Technical details

A prototype pollution vulnerability exists in the 'value' function within lib/index.js of the jsonpath package (version 1.1.1). The library fails to properly sanitize or validate special object keys such as '__proto__', 'constructor', or 'prototype' when processing path expressions. A remote, unauthenticated attacker can provide a specially crafted JSONPath expression to modify the global Object.prototype. This can lead to various impacts depending on the application environment, including denial of service, bypass of security checks, or remote code execution. Red Hat has released several security advisories (e.g., RHSA-2026:2180, RHSA-2026:3960) to address this vulnerability in its downstream products.

Affected products

  • dchester jsonpath 1.1.1
  • Red Hat Red Hat Ansible Automation Platform 2.0, 2.1, 2.5, 2.6
  • Red Hat Red Hat Developer Hub 1.8, 1.9
  • Red Hat Migration Toolkit for Virtualization 2
  • Red Hat OpenShift Pipelines 1
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat Fuse 7

Timeline

  • 2026-01-28: disclosed: Vulnerability details and proof-of-concept published via GitHub Gist.
  • 2026-01-28: advisory: CVE-2025-61140 published.
  • 2026-02-05: patched: Red Hat released initial security updates for Ansible Automation Platform.

References

Related threats