JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js
The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-61140US | — | — | ||
The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution. | ||||
02
references
External citations — patches, advisories, analysis.
- https://gist.github.com/Dremig/8105c189774217222a8ebea3ed4d341dWEB
- https://github.com/dchester/jsonpathPACKAGE
- https://github.com/dchester/jsonpath/commit/9631412641b7095f86840a7a45b5b3afc68b0fcbWEB
- https://github.com/dchester/jsonpath/issues/181WEB
- https://github.com/dchester/jsonpath/issues/194WEB
- https://github.com/dchester/jsonpath/pull/195WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-61140ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan