CVE-2025-61140: JSONPath vulnerable to Prototype… – CVSS 9.8 · Watchpost

← All vulnerabilities

JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js

严重 9.8CVE-2025-61140 · GHSA-6c59-mwgh-r2x6 · Published 28/01/2026 · updated 07/09/2026

要点

CVE-2025-61140 是影响 jsonpath (dchester), jsonpath 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：0.53%，高于 44.6% 的漏洞。
修复：升级到 1.2.0 或更高版本。

Package	Affected versions	Patched versions
jsonpath dchester	`= 1.1.1`	No fix yet
jsonpath npm	`< 1.2.0`	`1.2.0`

Description

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

NVD description

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

References

nvd.nist.gov/vuln/detail/CVE-2025-61140 · ADVISORY
dchester/jsonpath · WEB
dchester/jsonpath · WEB
dchester/jsonpath#195 · WEB
dchester/jsonpath commit 9631412 · WEB
gist.github.com/Dremig/8105c189774217222a8ebea3ed4d341d · WEB
dchester/jsonpath · PACKAGE
access.redhat.com/errata/RHSA-2026:2180 · Third Party Advisory
access.redhat.com/errata/RHSA-2026:2181 · Third Party Advisory
access.redhat.com/errata/RHSA-2026:3960 · Third Party Advisory
access.redhat.com/errata/RHSA-2026:3962 · Third Party Advisory
access.redhat.com/errata/RHSA-2026:6174 · Third Party Advisory
access.redhat.com/errata/RHSA-2026:6802 · Third Party Advisory
access.redhat.com/security/cve/CVE-2025-61140 · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Third Party Advisory
security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61140.json · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free