{"action":"Upgrade jsonpath to 1.2.0 or later.","affected":[{"fixed":"1.2.0","introduced":"0"}],"component":"jsonpath","cve_ids":["CVE-2025-61140"],"ecosystem":"npm","epss":0.00526,"exploited":false,"fixed_versions":["1.2.0"],"ghsa_id":"GHSA-6c59-mwgh-r2x6","id":"tcs_01M5KF6MRY0FNF14K1T5WJFNJH","modified_at":"2026-02-05T16:30:42.225658Z","published_at":"2026-01-28T18:30:47Z","references":["https://osv.dev/vulnerability/GHSA-6c59-mwgh-r2x6","https://nvd.nist.gov/vuln/detail/CVE-2025-61140","https://github.com/dchester/jsonpath/issues/181","https://github.com/dchester/jsonpath/issues/194","https://github.com/dchester/jsonpath/pull/195","https://github.com/dchester/jsonpath/commit/9631412641b7095f86840a7a45b5b3afc68b0fcb","https://gist.github.com/Dremig/8105c189774217222a8ebea3ed4d341d","https://github.com/dchester/jsonpath"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-6c59-mwgh-r2x6","url":"https://osv.dev/vulnerability/GHSA-6c59-mwgh-r2x6"},{"source":"nvd","source_id":"CVE-2025-61140","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61140"}],"summary":"JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js"}