Executive brief
mtdowling/jmespath.php is a PHP library used to query and filter JSON data using JMESPath expressions. When the library compiles JMESPath expressions to PHP code (via CompilerRuntime or the JP_PHP_COMPILE flag), it fails to safely escape function names, allowing an attacker to inject arbitrary PHP code into cached files. If an application accepts user-supplied JMESPath expressions for data filtering or transformation, an attacker can execute arbitrary code with the privileges of the PHP process, leading to complete system compromise.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the JMESPath expression compiler. When CompilerRuntime compiles a JMESPath expression to executable PHP, it extracts function names from the parsed expression tree and writes them into generated PHP source code without proper escaping or validation. An attacker who controls the JMESPath expression string can craft a non-identifier value where the parser accepts a function callee; this value is then emitted unescaped into the PHP source file. When the compiled cache file is loaded, the injected PHP code executes with the privilege level of the application. The default AstRuntime is unaffected unless JP_PHP_COMPILE is explicitly enabled. The vulnerability requires the attacker to control the expression string itself; data passed to the search() function alone is insufficient. A patch is available in version 2.9.1 and later.
Affected products
- mtdowling jmespath.php < 2.9.1
Timeline
- 2026-06-11: disclosed
- 2026-06-11: patched: Version 2.9.1 and later contain the patch
- 2026-08-18: advisory