Export limit exceeded: 425824 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425824 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425824 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 51970 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-1615

jsonpath: jsonpath: Arbitrary Code Execution via unsafe JSON Path expression evaluation

Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploit this vulnerability by supplying a malicious JSON Path expression that, when evaluated, executes arbitrary JavaScript code, leading to Remote Code Execution in Node.js environments or Cross-site Scripting (XSS) in browser contexts. This affects all methods that evaluate JSON Paths against objects, including .query, .nodes, .paths, .value, .parent, and .apply.

CVSS 4.0 · 9.2 Critical EPSS 1.1% KEV · Not listed
Vendors
Dchester
Products
Jsonpath
CVE-2025-61140

jsonpath: jsonpath: Prototype Pollution vulnerability in the value function

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Dchester
Products
Jsonpath