CRITICAL

CVE-2026-1615

jsonpath: jsonpath: Arbitrary Code Execution via unsafe JSON Path expression evaluation

CVSS v3

9.8

CRITICAL

EPSS Score

1.1 %

exploit probability, as of 2026-09-25

CISA KEV

known exploited

Exploitation

none

SSVC status

Description

Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploit this vulnerability by supplying a malicious JSON Path expression that, when evaluated, executes arbitrary JavaScript code, leading to Remote Code Execution in Node.js environments or Cross-site Scr

Technical details

Published: 2026-02-09
Last Modified: 2026-04-28

Frequently asked questions

What is CVE-2026-1615?

Is CVE-2026-1615 actively exploited?

Active exploitation of CVE-2026-1615 has not been confirmed. Its EPSS score was 1.1% on 2026-09-25, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-1615?

CVE-2026-1615 has a CVSS v3 base score of 9.8 (CRITICAL severity).

Is CVE-2026-1615 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IP Search CVEs SIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2026 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database