CVE-2026-54133: Jmespath PHP RCE Vulnerability

CVE-2026-54133 Overview

CVE-2026-54133 is a critical remote code execution vulnerability in jmespath.php, a PHP library that implements JMESPath for declaratively extracting elements from JSON documents. Versions prior to 2.9.1 allow attackers to generate and execute arbitrary PHP code when JmesPath\CompilerRuntime evaluates an attacker-controlled JMESPath expression. The compiler emits parsed function names into generated PHP source without sufficient escaping, producing a cache file that contains executable attacker-controlled code. The compiler runtime then loads this file, resulting in arbitrary code execution in the application context. Maintainers patched the issue in version 2.9.1.

Critical Impact
An unauthenticated remote attacker who can supply a JMESPath expression to an application using CompilerRuntime can achieve arbitrary PHP code execution, fully compromising confidentiality, integrity, and availability.

Affected Products

jmespath/jmespath.php versions prior to 2.9.1
PHP applications using JmesPath\CompilerRuntime with untrusted expressions
Applications with the JP_PHP_COMPILE environment variable enabled

Discovery Timeline

2026-06-12 - CVE-2026-54133 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54133

Vulnerability Analysis

The flaw is an improper input validation issue [CWE-20] in the JMESPath PHP compiler. jmespath.php offers two runtimes: AstRuntime, which interprets the parsed abstract syntax tree, and CompilerRuntime, which transpiles JMESPath expressions into PHP source files cached on disk for performance. The compiler writes parsed JMESPath function names directly into the generated PHP source. Because the emission step does not sufficiently escape or validate these tokens, a crafted expression can break out of the intended PHP string or identifier context and inject arbitrary PHP statements into the cache file. When CompilerRuntime subsequently includes the cache file to execute the compiled expression, the injected statements run with the privileges of the PHP process.

Root Cause

The root cause is unsafe code generation. The compiler treats parsed function identifiers as trusted text and concatenates them into PHP source without applying an allowlist or escape routine. Any caller that forwards untrusted input into JmesPath\Env::search() or equivalent helpers, with JP_PHP_COMPILE enabled, triggers the vulnerable path.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits a malicious JMESPath expression through any application input that is forwarded to the compiler runtime, such as a query parameter, JSON body field, or configuration value. The compiler writes the poisoned PHP cache file, includes it, and executes the attacker payload in-process. Verified proof-of-concept code is not published in the enriched data; refer to the GitHub Security Advisory GHSA-pcw8-m77r-2528 for maintainer-provided technical detail.

Detection Methods for CVE-2026-54133

Indicators of Compromise

Unexpected .php files written to the JMESPath compiler cache directory, often under sys_get_temp_dir() with names beginning with jmespath_
PHP process spawning shells, curl, wget, or outbound connections shortly after handling JSON or search requests
Web access logs containing JMESPath expressions with unusual characters in function names such as backticks, parentheses, semicolons, or PHP tags

Detection Strategies

Inventory PHP dependencies using composer show jmespath/jmespath and flag any version below 2.9.1
Static-scan application code for calls to JmesPath\CompilerRuntime, JmesPath\Env::search, or the JP_PHP_COMPILE environment variable used with user-supplied expressions
Enable file integrity monitoring on the JMESPath cache directory and alert on writes outside of deployment windows

Monitoring Recommendations

Log and review all JMESPath expressions received from external sources, including their length and character distribution
Monitor PHP-FPM and web server child processes for anomalous child execution using EDR process telemetry
Forward web application and PHP error logs to a centralized analytics platform and alert on syntax errors originating from generated cache files

How to Mitigate CVE-2026-54133

Immediate Actions Required

Upgrade jmespath/jmespath.php to version 2.9.1 or later using composer update jmespath/jmespath
Unset the JP_PHP_COMPILE environment variable across application, container, and CI environments until upgrade is verified
Audit application code paths that pass user input to JmesPath\Env::search() and route untrusted expressions through AstRuntime instead
Purge the JMESPath compiler cache directory to remove any previously generated PHP files that may contain injected code

Patch Information

The maintainers fixed the vulnerability in jmespath.php version 2.9.1. The patch sanitizes function names emitted into generated PHP source. Full remediation details are documented in the GitHub Security Advisory GHSA-pcw8-m77r-2528.

Workarounds

Disable JP_PHP_COMPILE and avoid instantiating JmesPath\CompilerRuntime for attacker-controlled input
Use the default AstRuntime for evaluating untrusted JMESPath expressions
If untrusted expressions must be accepted before upgrade, validate them against a strict allowlist of functions and operators before evaluation

bash

# Upgrade to the patched version and verify
composer require jmespath/jmespath:^2.9.1
composer show jmespath/jmespath | grep versions

# Disable the compiler runtime trigger
unset JP_PHP_COMPILE

# Remove any pre-existing compiler cache files
find "${TMPDIR:-/tmp}" -maxdepth 1 -name 'jmespath_*.php' -delete