{"action":"Upgrade jsonpath to 1.3.0 or later.","affected":[{"fixed":"1.3.0","introduced":"0"}],"component":"jsonpath","cve_ids":["CVE-2026-1615"],"ecosystem":"npm","epss":0.01166,"exploited":false,"fixed_versions":["1.3.0"],"ghsa_id":"GHSA-87r5-mp6g-5w5j","id":"tcs_01M5KFC5RMK5F1QKGTPKT9TDVM","modified_at":"2026-03-19T16:31:29.559898Z","published_at":"2026-02-09T06:30:28Z","references":["https://osv.dev/vulnerability/GHSA-87r5-mp6g-5w5j","https://nvd.nist.gov/vuln/detail/CVE-2026-1615","https://github.com/dchester/jsonpath/pull/197","https://github.com/dchester/jsonpath/commit/491e2e01de2ff13f7d95e87eb2be726edbf4225f","https://github.com/dchester/jsonpath/commit/b61111f07ac1a8d0f3133b5fc51438ecb76a6c39","https://github.com/dchester/jsonpath","https://github.com/dchester/jsonpath/blob/c1dd8ec74034fb0375233abb5fdbec51ac317b4b/lib/handlers.js#L243","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15141219","https://security.snyk.io/vuln/SNYK-JS-JSONPATH-13645034"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-87r5-mp6g-5w5j","url":"https://osv.dev/vulnerability/GHSA-87r5-mp6g-5w5j"}],"summary":"jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions"}