PT-2026-6378 · Npm · Jsonpath

Publicado 2026-01-28 · Atualizado 2026-01-28

OSV

CVSS v4.0

6.6

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

GHSA-6C59-MWGH-R2X6

Produtos afetados

Jsonpath

Referências · 8

• https://github.com/dchester/jsonpath · Nota
• https://github.com/dchester/jsonpath/commit/9631412641b7095f86840a7a45b5b3afc68b0fcb · Nota
• https://github.com/dchester/jsonpath/issues/194 · Nota
• https://github.com/dchester/jsonpath/pull/195 · Nota
• https://github.com/dchester/jsonpath/issues/181 · Nota
• https://gist.github.com/Dremig/8105c189774217222a8ebea3ed4d341d · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-61140 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-6c59-mwgh-r2x6 · Aviso do Fabricante