PT-2026-48883 · Unknown · Jmespath.Php

Edorian · CVE-2026-54133 · Published 2026-06-12 · Updated 2026-07-01

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions jmespath.php versions prior to 2.9.1

Description Insufficient escaping of parsed JMESPath function names into generated PHP source allows for the generation and execution of attacker-controlled PHP code. This occurs when JmesPathCompilerRuntime is used with a crafted JMESPath expression, causing the generated cache file to contain executable code that is subsequently loaded by the compiler runtime.

Recommendations Update to version 2.9.1 or later. Disable JP PHP COMPILE as a temporary workaround. Avoid using JmesPathCompilerRuntime with attacker-controlled expressions and use the default AstRuntime for untrusted expressions instead.

Exploit

Fix

RCE

Code Injection

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-94

CWE-20

CWE-116

Related Identifiers

CVE-2026-54133

GHSA-PCW8-M77R-2528

Affected Products

Jmespath.Php

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54133.json · Exploit
• 🔥 https://github.com/jmespath/jmespath.php/security/advisories/GHSA-pcw8-m77r-2528 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-54133 · Security Note
• https://osv.dev/vulnerability/CVE-2026-54133 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-COMPOSER-CVE-2026-54133 · Vendor Advisory
• https://twitter.com/DFIR_Lab/status/2065606449221308576 · Twitter Post
• https://t.me/cveNotify/167487 · Telegram Post
• https://twitter.com/CVEnew/status/2065461484126081294 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2065470907942846691 · Twitter Post