Critical, CVSS 9.8PackagistAmendedPublished
jmespath.php has CompilerRuntime code injection via unescaped function names
CVE-2026-54133 · GHSA-pcw8-m77r-2528
- Affected
- Packagist mtdowling/jmespath.php < 2.9.1
- Fixed in
- 2.9.1· Vendor fix available
- Issue
- Impact mtdowling/jmespath.php can generate and execute attacker-controlled PHP code when JmesPath\CompilerRuntime is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. A vulnerable flow is: 1. An application accepts or constructs a JMESPath expression using attacker-controlled input. 2. The expression is evaluated with JmesPath\CompilerRuntime, or with JmesPath\search() while JPPHPCOMPILE is enabled. 3. The crafted expression uses a non-identifier value where the parser accepts a function callee. 4. The compiler writes that value into generated PHP source without safely escaping it as a PHP string literal. 5. The generated source is written to the compiled-expression cache directory. 6. CompilerRuntime loads the generated cache…
Recommended action: Upgrade to 2.9.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.