CVE-2026-1615: jsonpath Package RCE Vulnerability

CVE-2026-1615 Overview

CVE-2026-1615 is a critical arbitrary code injection vulnerability affecting all versions of the jsonpath npm package. The vulnerability exists due to unsafe evaluation of user-supplied JSON Path expressions through the static-eval module, which is not designed to handle untrusted data safely. This flaw enables attackers to execute arbitrary JavaScript code in Node.js environments or achieve Cross-site Scripting (XSS) in browser contexts.

Critical Impact

Attackers can achieve Remote Code Execution (RCE) in Node.js server environments or execute malicious scripts in user browsers by crafting malicious JSON Path expressions, potentially compromising entire application infrastructure.

Affected Products

• jsonpath npm package (all versions)
• org.webjars.npm:jsonpath (Java WebJars wrapper)
• Applications using jsonpath methods: .query, .nodes, .paths, .value, .parent, and .apply

Discovery Timeline

• 2026-02-09 - CVE-2026-1615 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-1615

Vulnerability Analysis

This vulnerability represents a classic code injection flaw (CWE-94) stemming from insufficient input validation when processing JSON Path expressions. The jsonpath library delegates expression evaluation to the static-eval module, which was designed for processing trusted code in controlled environments—not for sanitizing arbitrary user input.

When an application passes user-controlled JSON Path strings to any of the vulnerable methods (.query, .nodes, .paths, .value, .parent, or .apply), the static-eval module interprets and executes the expression. An attacker can craft a malicious JSON Path that breaks out of the intended evaluation context and executes arbitrary JavaScript code.

In Node.js environments, successful exploitation grants attackers the ability to execute system commands, read sensitive files, establish reverse shells, or pivot to other systems. In browser contexts, the vulnerability manifests as XSS, enabling session hijacking, credential theft, or delivery of malicious payloads to users.

Root Cause

The root cause lies in the architectural decision to use static-eval for processing JSON Path expressions without implementing proper sandboxing or input sanitization. The static-eval module explicitly states it is not suitable for evaluating untrusted code, yet the jsonpath library passes user input directly to it. The vulnerable code path can be traced to the handlers.js file where expression evaluation occurs without adequate security controls.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker needs only to supply a malicious JSON Path expression to an application endpoint that processes JSON Path queries. Common attack scenarios include:

• REST APIs accepting JSON Path parameters for data filtering
• GraphQL resolvers using jsonpath for field selection
• Web applications with client-side JSON Path evaluation
• Backend services processing JSON Path expressions from message queues or external data sources

The exploitation mechanism involves injecting JavaScript code within a JSON Path expression that appears syntactically valid but contains payloads that execute during evaluation. The lack of input validation means attackers can leverage JavaScript's dynamic evaluation capabilities to break out of the intended sandboxed context.

Detection Methods for CVE-2026-1615

Indicators of Compromise

• Unusual JSON Path expressions in application logs containing JavaScript syntax such as require(), eval(), process, or child_process
• Unexpected outbound network connections from Node.js application processes
• Anomalous process spawning originating from the Node.js runtime
• Application errors or crashes related to JSON Path evaluation with stack traces referencing static-eval

Detection Strategies

• Implement application-layer monitoring to flag JSON Path inputs containing JavaScript keywords or dangerous function names
• Deploy runtime application self-protection (RASP) to detect and block code injection attempts
• Configure web application firewalls (WAF) with rules to detect JSON Path injection patterns
• Enable detailed logging of all JSON Path operations including the full expression string for forensic analysis

Monitoring Recommendations

• Audit all application dependencies using npm audit or similar tools to identify vulnerable jsonpath installations
• Monitor process execution patterns for Node.js applications to detect unauthorized command execution
• Implement alerting for unusual JavaScript evaluation patterns in application telemetry
• Review application logs for JSON Path expressions containing suspicious patterns like constructor, __proto__, or function invocations

How to Mitigate CVE-2026-1615

Immediate Actions Required

• Identify all applications and services using the jsonpath npm package or its WebJars wrapper
• Implement strict input validation to sanitize or reject JSON Path expressions from untrusted sources
• Consider replacing jsonpath with alternative libraries that implement proper sandboxing for untrusted input
• Deploy additional network segmentation to limit the blast radius of potential RCE exploitation

Patch Information

At the time of publication, no official patch is available for the jsonpath package. The vulnerability affects all versions of the library. Organizations should consult the Snyk JavaScript vulnerability advisory and Snyk Java vulnerability advisory for the latest remediation guidance. The vulnerable code resides in the handlers.js file of the jsonpath repository.

Workarounds

• Implement a whitelist-based validation layer that only permits known-safe JSON Path patterns
• Wrap jsonpath calls with input sanitization that strips or escapes potential code injection payloads
• Run Node.js applications processing untrusted JSON Path input in isolated containers with minimal privileges
• Consider using alternative JSON Path implementations such as jsonpath-plus with appropriate security configurations

# Identify vulnerable jsonpath installations in your project
npm ls jsonpath

# Check for known vulnerabilities in dependencies
npm audit

# Consider using an alternative package with security controls
npm uninstall jsonpath
npm install jsonpath-plus --save