What’s Vulnerable › Vulnerabilities

CVE-2025-61140

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-28 · updated 2026-09-07
• Weakness: CWE-1321

Description

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

Affected products

• Dchester Jsonpath: 1.1.1

References

• https://gist.github.com/Dremig/8105c189774217222a8ebea3ed4d341d
• https://github.com/dchester/jsonpath
• https://access.redhat.com/errata/RHSA-2026:2180
• https://access.redhat.com/errata/RHSA-2026:2181
• https://access.redhat.com/errata/RHSA-2026:3960
• https://access.redhat.com/errata/RHSA-2026:3962
• https://access.redhat.com/errata/RHSA-2026:6174
• https://access.redhat.com/errata/RHSA-2026:6802
• https://access.redhat.com/security/cve/CVE-2025-61140
• https://bugzilla.redhat.com/show_bug.cgi?id=2433946
• https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61140.json

Get alerted when CVE-2025-61140 or the next vulnerability affects your stack