CVE-2026-1615: dchester jsonpath code injection via unsafe evaluation

CVE-2026-1615 · Severity: critical · CVSS 9.8 · Published 2026-02-09

The jsonpath library, a tool used to search and manipulate data in JavaScript applications, is vulnerable to a critical security flaw. An attacker can use specially crafted search queries to run unauthorized commands on the server or in a user's browser. This could lead to a complete takeover of the affected system, theft of sensitive data, or disruption of business operations.

Technologies: Dchester Jsonpath, Red Hat Developer Hub. Vendors: Dchester, npm, Red Hat.

Quick answers

Is CVE-2026-1615 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-1615 being exploited in the wild.
How severe is CVE-2026-1615?
Critical severity, with a CVSS score of 9.8, published 9 February 2026.
Which products and versions are affected?
Dchester Jsonpath < 1.3.0; jsonpath (npm) SEMVER:introduced=0,fixed=1.3.0; Red Hat Developer Hub el9.
Is there a fix for CVE-2026-1615?
Yes. jsonpath (npm): upgrade to 1.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-1615 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-1615?
Check whether you run Dchester Jsonpath, jsonpath (npm) or Red Hat Developer Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • jsonpath (npm): upgrade to 1.3.0 or later
    npm install jsonpath@1.3.0

Technical details

The jsonpath library (versions prior to 1.3.0) is vulnerable to arbitrary code injection because it uses the 'static-eval' module to process JSON Path expressions. 'static-eval' is not designed to safely handle untrusted input, allowing an attacker to bypass sandbox restrictions and execute arbitrary JavaScript. This vulnerability affects all core methods including .query(), .nodes(), and .apply(). In Node.js environments, this can result in Remote Code Execution (RCE), while in browser-based environments, it can lead to Cross-Site Scripting (XSS). The fix, introduced in version 1.3.0, involves blacklisting unsafe property names like 'constructor' and '__proto__' to prevent prototype pollution and constructor escape attacks.

Affected products

  • dchester jsonpath < 1.3.0
  • n/a org.webjars.npm:jsonpath < 1.3.0
  • Red Hat Red Hat Ansible Automation Platform 2.5 el8
  • Red Hat Red Hat Ansible Automation Platform 2.6 el9
  • Red Hat Red Hat Developer Hub 1.9 el9

Identifiers

  • CVE-2026-1615
  • GHSA-87r5-mp6g-5w5j

Timeline

  • 2025-06-20: disclosed: Vulnerability disclosed by Nick Copi
  • 2026-02-05: advisory: Snyk advisory published
  • 2026-02-09: advisory: NVD publication date
  • 2026-03-05: patched: GitHub commit b61111f merged to fix the issue
  • 2026-03-31: patched: Red Hat released security advisory RHSA-2026:6308

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.