Junglewise Threat Intelligence

CVE-2026-1615: dchester jsonpath code injection via unsafe evaluation

CVE-2026-1615 · Severity: critical · CVSS 9.8 · Published 2026-02-09

Technologies: Dchester Jsonpath, Red Hat Developer Hub. Vendors: Red Hat, Dchester.

Executive brief

The jsonpath library, a tool used to search and manipulate data in JavaScript applications, is vulnerable to a critical security flaw. An attacker can use specially crafted search queries to run unauthorized commands on the server or in a user's browser. This could lead to a complete takeover of the affected system, theft of sensitive data, or disruption of business operations.

Technical details

The jsonpath library (versions prior to 1.3.0) is vulnerable to arbitrary code injection because it uses the 'static-eval' module to process JSON Path expressions. 'static-eval' is not designed to safely handle untrusted input, allowing an attacker to bypass sandbox restrictions and execute arbitrary JavaScript. This vulnerability affects all core methods including .query(), .nodes(), and .apply(). In Node.js environments, this can result in Remote Code Execution (RCE), while in browser-based environments, it can lead to Cross-Site Scripting (XSS). The fix, introduced in version 1.3.0, involves blacklisting unsafe property names like 'constructor' and '__proto__' to prevent prototype pollution and constructor escape attacks.

Affected products

  • dchester jsonpath < 1.3.0
  • n/a org.webjars.npm:jsonpath < 1.3.0
  • Red Hat Red Hat Ansible Automation Platform 2.5 el8
  • Red Hat Red Hat Ansible Automation Platform 2.6 el9
  • Red Hat Red Hat Developer Hub 1.9 el9

Timeline

  • 2025-06-20: disclosed: Vulnerability disclosed by Nick Copi
  • 2026-02-05: advisory: Snyk advisory published
  • 2026-02-09: advisory: NVD publication date
  • 2026-03-05: patched: GitHub commit b61111f merged to fix the issue
  • 2026-03-31: patched: Red Hat released security advisory RHSA-2026:6308

References

Related threats