# CVE-2025-61140: dchester jsonpath prototype pollution in value function

Source: https://junglewise.ai/threats/cve-2025-61140-dchester-jsonpath-prototype-pollution-in-value-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-28. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2025-61140 · Severity: critical · CVSS 9.8 · Published 2026-01-28

A vulnerability exists in the jsonpath library, a tool used by developers to search and manipulate data within JavaScript objects. This library is integrated into several enterprise products, including Red Hat Ansible Automation Platform and OpenShift. An attacker could exploit this flaw to modify the underlying behavior of the application, potentially leading to unauthorized data access, service disruption, or full system takeover.

Technologies: [Dchester Jsonpath](https://junglewise.ai/threats/technologies/jsonpath), [Red Hat Developer Hub](https://junglewise.ai/threats/technologies/developer-hub). Vendors: [Dchester](https://junglewise.ai/threats/vendors/dchester), [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2025-61140 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61140 being exploited in the wild.

**How severe is CVE-2025-61140?** Critical severity, with a CVSS score of 9.8, published 28 January 2026.

**Which products and versions are affected?** Dchester Jsonpath 1.1.1; jsonpath (npm) SEMVER:introduced=0,fixed=1.2.0; Red Hat Developer Hub 1.8, 1.9.

**Is there a fix for CVE-2025-61140?** Yes. jsonpath (npm): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-61140 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-61140?** Check whether you run Dchester Jsonpath, jsonpath (npm) or Red Hat Developer Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jsonpath (npm): upgrade to 1.2.0 or later

  ```sh
  npm install jsonpath@1.2.0
  ```


## Technical details

A prototype pollution vulnerability exists in the 'value' function within lib/index.js of the jsonpath package (version 1.1.1). The library fails to properly sanitize or validate special object keys such as '__proto__', 'constructor', or 'prototype' when processing path expressions. A remote, unauthenticated attacker can provide a specially crafted JSONPath expression to modify the global Object.prototype. This can lead to various impacts depending on the application environment, including denial of service, bypass of security checks, or remote code execution. Red Hat has released several security advisories (e.g., RHSA-2026:2180, RHSA-2026:3960) to address this vulnerability in its downstream products.

## Affected products

- dchester jsonpath 1.1.1
- Red Hat Red Hat Ansible Automation Platform 2.0, 2.1, 2.5, 2.6
- Red Hat Red Hat Developer Hub 1.8, 1.9
- Red Hat Migration Toolkit for Virtualization 2
- Red Hat OpenShift Pipelines 1
- Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Red Hat Fuse 7

## Identifiers

- CVE-2025-61140
- GHSA-6c59-mwgh-r2x6

## Timeline

- 2026-01-28: disclosed: Vulnerability details and proof-of-concept published via GitHub Gist.
- 2026-01-28: advisory: CVE-2025-61140 published.
- 2026-02-05: patched: Red Hat released initial security updates for Ansible Automation Platform.

## References

- [https://gist.github.com/Dremig/8105c189774217222a8ebea3ed4d341d](https://gist.github.com/Dremig/8105c189774217222a8ebea3ed4d341d)
- [https://github.com/dchester/jsonpath](https://github.com/dchester/jsonpath)
- [https://access.redhat.com/errata/RHSA-2026:2180](https://access.redhat.com/errata/RHSA-2026:2180)
- [https://access.redhat.com/errata/RHSA-2026:2181](https://access.redhat.com/errata/RHSA-2026:2181)
- [https://access.redhat.com/errata/RHSA-2026:3960](https://access.redhat.com/errata/RHSA-2026:3960)
- [https://access.redhat.com/errata/RHSA-2026:3962](https://access.redhat.com/errata/RHSA-2026:3962)
- [https://access.redhat.com/errata/RHSA-2026:6174](https://access.redhat.com/errata/RHSA-2026:6174)

## Related threats

- [patriksimek vm2 remote code execution via NodeVM allowlist bypass](https://junglewise.ai/threats/cve-2026-43999-patriksimek-vm2-remote-code-execution-via-nodevm-allowlist-bypass)
- [patriksimek vm2 remote code execution via symlink traversal in NodeVM](https://junglewise.ai/threats/cve-2026-43998-patriksimek-vm2-remote-code-execution-via-symlink-traversal-in)
- [protobufjs code injection in toObject function generation](https://junglewise.ai/threats/cve-2026-44293-protobufjs-code-injection-in-toobject-function-generation)
- [Fastify fast-uri host confusion via percent-encoded authority delimiters](https://junglewise.ai/threats/cve-2026-6322-fastify-fast-uri-host-confusion-via-percent-encoded-authority)
- [OpenJS Foundation fast-uri path traversal via percent-encoded dot segments](https://junglewise.ai/threats/cve-2026-6321-openjs-foundation-fast-uri-path-traversal-via-percent-encoded-dot)