SNYK report critical security vulnerability against all version of jsonpath

[klyinliu]

https://security.snyk.io/vuln/SNYK-JS-JSONPATH-13645034

[mikeCapozziICF]

I too am receiving this.

[afiller]

Any updates on this? It can be critical especially when the lib is used in server environments if I understand it correctly. Thanks in advance.

[Kartrag]

Any update on when we can receive fix for this since its Critical

[c-goettert]

Please fix this 🙏

[klyinliu]

Adding more info:
CVE: https://www.cve.org/CVERecord?id=CVE-2026-1615

Description
All versions of the package jsonpath are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploit this vulnerability by supplying a malicious JSON Path expression that, when evaluated, executes arbitrary JavaScript code, leading to Remote Code Execution in Node.js environments or Cross-site Scripting (XSS) in browser contexts. This affects all methods that evaluate JSON Paths against objects, including .query, .nodes, .paths, .value, .parent, and .apply.

[adelimon]

Reading up on this, the fix is to allow list only needed expressions in eval, and error on anything else.

[maker2413]

The CVE link: https://www.cve.org/CVERecord?id=CVE-2026-1615 seems to indicate that version 1.2.1 (released February 5th 2026) resolves this issue. Is anyone able to confirm?

[chellman]

The CVE link: cve.org/CVERecord?id=CVE-2026-1615 seems to indicate that version 1.2.1 (released February 5th 2026) resolves this issue. Is anyone able to confirm?

I don't think that's the case. At least dependabot doesn't think so, listing 1.2.1 and below as vulnerable.

[mikeCapozziICF]

@maker2413 - I ran snyk test and can confirm 1.2.1 does not fix the vulnerability as I have an override to force tht but still get:

Arbitrary Code Injection [Critical Severity][https://security.snyk.io/vuln/SNYK-JS-JSONPATH-13645034] in jsonpath@1.2.1
introduced by react-scripts@5.0.1 > bfj@7.1.0 > jsonpath@1.2.1

[adelimon]

I think that this manifests in a different want in 1.2.1, or Synk is just incorrect about that version fixing it because I see the same. When I pulled down the code and did an analysis of it, 1.2.1 also still has the issue.

[maker2413]

Thanks for confirming everyone! I would love to help out with a proper fix, but admittedly I'm an amateur JavaScript developer at best and I'm also spread a little thin. That being said I see there is a proposed PR and if there is any way I can help please let me know.

[Wajih-Ul-Hasan]

Could someone explain how this vulnerability might be exploited? Because it is a development dependency, it cannot be included in the production build folder.
@klyinliu
@mikeCapozziICF

[klyinliu]

Closing the issue as both SNYK and CVE report confirm the issue doesn't apply to version 1.2.0 or 1.2.1

[samuelogboye]

@klyinliu I'm still getting the vulnerability alert for 1.2.1, how did you come to that conclusion?