CVE-2026-54133

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54133", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-11T21:15:33.870Z", "datePublished": "2026-06-12T13:56:37.874Z", "dateUpdated": "2026-06-12T15:07:16.654Z"}, "containers": {"cna": {"title": "jmespath.php has CompilerRuntime code injection via unescaped function names", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/jmespath/jmespath.php/security/advisories/GHSA-pcw8-m77r-2528", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jmespath/jmespath.php/security/advisories/GHSA-pcw8-m77r-2528"}], "affected": [{"vendor": "jmespath", "product": "jmespath.php", "versions": [{"version": "< 2.9.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T13:56:37.874Z"}, "descriptions": [{"lang": "en", "value": "jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. The issue is patched in `2.9.1` and later. As a workaround, disable `JP_PHP_COMPILE` and do not use `JmesPath\\CompilerRuntime` with attacker-controlled expressions. Use the default `AstRuntime` for untrusted expressions. Applications that must continue accepting untrusted JMESPath expressions before upgrading should ensure those expressions are never evaluated by the compiler runtime."}], "source": {"advisory": "GHSA-pcw8-m77r-2528", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/jmespath/jmespath.php/security/advisories/GHSA-pcw8-m77r-2528", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-12T15:07:03.703942Z", "id": "CVE-2026-54133", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T15:07:16.654Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54133", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-12T15:07:03.703942Z"}}}], "references": [{"url": "https://github.com/jmespath/jmespath.php/security/advisories/GHSA-pcw8-m77r-2528", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T15:06:56.764Z"}}], "cna": {"title": "jmespath.php has CompilerRuntime code injection via unescaped function names", "source": {"advisory": "GHSA-pcw8-m77r-2528", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "jmespath", "product": "jmespath.php", "versions": [{"status": "affected", "version": "< 2.9.1"}]}], "references": [{"url": "https://github.com/jmespath/jmespath.php/security/advisories/GHSA-pcw8-m77r-2528", "name": "https://github.com/jmespath/jmespath.php/security/advisories/GHSA-pcw8-m77r-2528", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. The issue is patched in `2.9.1` and later. As a workaround, disable `JP_PHP_COMPILE` and do not use `JmesPath\\CompilerRuntime` with attacker-controlled expressions. Use the default `AstRuntime` for untrusted expressions. Applications that must continue accepting untrusted JMESPath expressions before upgrading should ensure those expressions are never evaluated by the compiler runtime."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T13:56:37.874Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54133", "state": "PUBLISHED", "dateUpdated": "2026-06-12T15:07:16.654Z", "dateReserved": "2026-06-11T21:15:33.870Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-12T13:56:37.874Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "jmespath.php", "vendor": "jmespath", "versions": [{"status": "affected", "version": "< 2.9.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jmespath:jmespath:*:*:*:*:*:php:*:*", "matchCriteriaId": "2F2D7DD9-AC56-45ED-AD62-DC5023908049", "versionEndExcluding": "2.9.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. The issue is patched in `2.9.1` and later. As a workaround, disable `JP_PHP_COMPILE` and do not use `JmesPath\\CompilerRuntime` with attacker-controlled expressions. Use the default `AstRuntime` for untrusted expressions. Applications that must continue accepting untrusted JMESPath expressions before upgrading should ensure those expressions are never evaluated by the compiler runtime."}, {"lang": "es", "value": "jmespath.php permite a los usuarios usar JMESPath, software para especificar declarativamente c\u00f3mo extraer elementos de un documento JSON, en aplicaciones PHP con estructuras de datos PHP. Las versiones anteriores a la 2.9.1 pueden generar y ejecutar c\u00f3digo PHP controlado por el atacante cuando se usa \u201cJmesPath\\CompilerRuntime\u201d con una expresi\u00f3n JMESPath controlada por el atacante. El compilador emite nombres de funciones JMESPath analizados en el c\u00f3digo fuente PHP generado sin suficiente escape. Una expresi\u00f3n manipulada puede hacer que el archivo de cach\u00e9 generado contenga PHP ejecutable controlado por el atacante, que luego es cargado por el tiempo de ejecuci\u00f3n del compilador. El problema est\u00e1 parcheado en \u201c2.9.1\u201d y versiones posteriores. Como soluci\u00f3n alternativa, deshabilite \u201cJP_PHP_COMPILE\u201d y no use \u201cJmesPath\\CompilerRuntime\u201d con expresiones controladas por el atacante. Use el \u201cAstRuntime\u201d predeterminado para expresiones no confiables. Las aplicaciones que deben seguir aceptando expresiones JMESPath no confiables antes de la actualizaci\u00f3n deben asegurarse de que esas expresiones nunca sean evaluadas por el tiempo de ejecuci\u00f3n del compilador."}], "id": "CVE-2026-54133", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54133", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-12T15:07:03.703942Z", "version": "2.0.3"}}]}, "published": "2026-06-12T15:16:31.890", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/jmespath/jmespath.php/security/advisories/GHSA-pcw8-m77r-2528"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/jmespath/jmespath.php/security/advisories/GHSA-pcw8-m77r-2528"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-116"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.9.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "jmespath.php", "source": "cna", "vendor": "jmespath"}, "product": "jmespath.php", "vendor": "jmespath"}], "created": "2026-06-12T15:45:09.219104+00:00", "updated": "2026-06-12T20:20:16.453158+00:00", "vendors": ["jmespath", "jmespath$PRODUCT$jmespath.php"]}