CVE-2026-54133: jmespath.php has CompilerRuntime code injection via unescaped function names

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-12 · updated 2026-10-25
Weakness: CWE-20

Description

jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. The issue is patched in `2.9.1` and later. As a workaround, disable `JP_PHP_COMPILE` and do not use `JmesPath\CompilerRuntime` with attacker-controlled expressions. Use the default `AstRuntime` for untrusted expressions. Applications that must continue accepting untrusted JMESPath expressions before upgrading should ensure those expressions are never evaluated by the compiler runtime.

Affected products

jmespath.php: before 2.9.1 — fixed in 2.9.1
Packagist Mtdowling/Jmespath.Php: before 2.9.1; 0.1.0, 0.2.0, 0.3.0, 0.4.0, 1.0.0, 1.1.0 (+12) — fixed in 2.9.1

How to fix

Upgrade to a fixed version: jmespath.php 2.9.1; Packagist Mtdowling/Jmespath.Php 2.9.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-54133 or the next vulnerability affects your stack